fix(publication): authenticate rotation handoffs

[rynfar]

Problem

Post-#47 preview testing safely exposed two remaining consumer-journal races: an authenticated claim can be removed while a reader still holds its inode, and a paused rotation can observe a pre-intent root handoff. The previous convergence checks did not bind removed claim bytes to an immutable identity, and a filename-only higher checkpoint could be mistaken for a real epoch advance.

Fix

• Publish new claims as canonical digest-named content plus an immutable generation index, while keeping legacy undigested claims readable but ineligible for removal convergence.
• Bind bounded async and sync reads to an exact SHA-256 anchor. The typed unlink signal now requires the same opened inode, stable bounds, a positive-to-zero link transition, final path absence, and exact anchored bytes.
• Authenticate every changed journal root with bounded canonical reads. Only one exact +1 successor can produce the typed epoch handoff.
• Authenticate in-progress next epochs against the exact latest rotation intent, while preserving exact current and retained-predecessor cleanup states.
• Keep malformed, missing, skipped, competing, symlink, replacement, modification, truncation, and I/O cases terminal.
• Sort unindexed claim validation by numeric generation and lexical digest for canonical failures.

Deterministic coverage

Coverage includes same-inode removal convergence, equal-size overwrite with restored mtime in async and sync readers, pre-intent handoff, malicious same-epoch checkpoints in hostile readdir order, sibling epoch directories, malformed/missing/skipped/competing successors, injected I/O failures, canonical unindexed-claim ordering, crash points, live temporaries, and concurrent process waves. Root-competitor tests also prove no claim, terminal, or transition publication occurs.

Verification

• node --check on both changed libraries and the publication test
• focused consumer-lock target: 1/1
• publication suite: 33/33 three times on the final tree, including two parallel runs
• release suite: 10/10
• GitHub App acceptance: 6/6
• npm run check (Biome 964 files, tsgo, installer render, browser smoke)
• strict offline double pack with Node 22.23.2/npm 11.10.1; all five outputs were byte-identical
• validation used isolated fixtures/snapshots and did not mutate live consumer state

No workflow was rerun, and no release, tag, approval, or merge was performed.

Refs pylon-code/pylon#193

GPT-5.6 via Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Post-#47 preview testing safely exposed two remaining consumer-journal races: an authenticated claim can be removed while a reader still holds its inode, and a paused rotation can observe a pre-intent root handoff. The previous convergence checks did not bind removed claim bytes to an immutable identity, and a filename-only higher checkpoint could be mistaken for a real epoch advance.

Fix

• Publish new claims as canonical digest-named content plus an immutable generation index, while keeping legacy undigested claims readable but ineligible for removal convergence.
• Bind bounded async and sync reads to an exact SHA-256 anchor. The typed unlink signal now requires the same opened inode, stable bounds, a positive-to-zero link transition, final path absence, and exact anchored bytes.
• Authenticate every changed journal root with bounded canonical reads. Only one exact +1 successor can produce the typed epoch handoff.
• Authenticate in-progress next epochs against the exact latest rotation intent, while preserving exact current and retained-predecessor cleanup states.
• Keep malformed, missing, skipped, competing, symlink, replacement, modification, truncation, and I/O cases terminal.
• Sort unindexed claim validation by numeric generation and lexical digest for canonical failures.

Deterministic coverage

Coverage includes same-inode removal convergence, equal-size overwrite with restored mtime in async and sync readers, pre-intent handoff, malicious same-epoch checkpoints in hostile readdir order, sibling epoch directories, malformed/missing/skipped/competing successors, injected I/O failures, canonical unindexed-claim ordering, crash points, live temporaries, and concurrent process waves. Root-competitor tests also prove no claim, terminal, or transition publication occurs.

Verification

• node --check on both changed libraries and the publication test
• focused consumer-lock target: 1/1
• publication suite: 33/33 three times on the final tree, including two parallel runs
• release suite: 10/10
• GitHub App acceptance: 6/6
• npm run check (Biome 964 files, tsgo, installer render, browser smoke)
• strict offline double pack with Node 22.23.2/npm 11.10.1; all five outputs were byte-identical
• validation used isolated fixtures/snapshots and did not mutate live consumer state

No workflow was rerun, and no release, tag, approval, or merge was performed.

Refs pylon-code/pylon#193

GPT-5.6 via Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Post-#47 preview testing safely exposed two remaining consumer-journal races: an authenticated claim can be removed while a reader still holds its inode, and a paused rotation can observe a pre-intent root handoff. The previous convergence checks did not bind removed claim bytes to an immutable identity, and a filename-only higher checkpoint could be mistaken for a real epoch advance.

Fix

• Publish new claims as canonical digest-named content plus an immutable generation index, while keeping legacy undigested claims readable but ineligible for removal convergence.
• Bind bounded async and sync reads to an exact SHA-256 anchor. The typed unlink signal now requires the same opened inode, stable bounds, a positive-to-zero link transition, final path absence, and exact anchored bytes.
• Authenticate every changed journal root with bounded canonical reads. Only one exact +1 successor can produce the typed epoch handoff.
• Authenticate in-progress next epochs against the exact latest rotation intent, while preserving exact current and retained-predecessor cleanup states.
• Keep malformed, missing, skipped, competing, symlink, replacement, modification, truncation, and I/O cases terminal.
• Sort unindexed claim validation by numeric generation and lexical digest for canonical failures.

Deterministic coverage

Coverage includes same-inode removal convergence, equal-size overwrite with restored mtime in async and sync readers, pre-intent handoff, malicious same-epoch checkpoints in hostile readdir order, sibling epoch directories, malformed/missing/skipped/competing successors, injected I/O failures, canonical unindexed-claim ordering, crash points, live temporaries, and concurrent process waves. Root-competitor tests also prove no claim, terminal, or transition publication occurs.

Verification

• node --check on both changed libraries and the publication test
• focused consumer-lock target: 1/1
• publication suite: 33/33 three times on the final tree, including two parallel runs
• release suite: 10/10
• GitHub App acceptance: 6/6
• npm run check (Biome 964 files, tsgo, installer render, browser smoke)
• strict offline double pack with Node 22.23.2/npm 11.10.1; all five outputs were byte-identical
• validation used isolated fixtures/snapshots and did not mutate live consumer state

No workflow was rerun, and no release, tag, approval, or merge was performed.

Refs pylon-code/pylon#193

GPT-5.6 via Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Post-#47 preview testing safely exposed two remaining consumer-journal races: an authenticated claim can be removed while a reader still holds its inode, and a paused rotation can observe a pre-intent root handoff. The previous convergence checks did not bind removed claim bytes to an immutable identity, and a filename-only higher checkpoint could be mistaken for a real epoch advance.

Fix

• Publish new claims as canonical digest-named content plus an immutable generation index, while keeping legacy undigested claims readable but ineligible for removal convergence.
• Bind bounded async and sync reads to an exact SHA-256 anchor. The typed unlink signal now requires the same opened inode, stable bounds, a positive-to-zero link transition, final path absence, and exact anchored bytes.
• Authenticate every changed journal root with bounded canonical reads. Only one exact +1 successor can produce the typed epoch handoff.
• Authenticate in-progress next epochs against the exact latest rotation intent, while preserving exact current and retained-predecessor cleanup states.
• Keep malformed, missing, skipped, competing, symlink, replacement, modification, truncation, and I/O cases terminal.
• Sort unindexed claim validation by numeric generation and lexical digest for canonical failures.

Deterministic coverage

Coverage includes same-inode removal convergence, equal-size overwrite with restored mtime in async and sync readers, pre-intent handoff, malicious same-epoch checkpoints in hostile readdir order, sibling epoch directories, malformed/missing/skipped/competing successors, injected I/O failures, canonical unindexed-claim ordering, crash points, live temporaries, and concurrent process waves. Root-competitor tests also prove no claim, terminal, or transition publication occurs.

Verification

• node --check on both changed libraries and the publication test
• focused consumer-lock target: 1/1
• publication suite: 33/33 three times on the final tree, including two parallel runs
• release suite: 10/10
• GitHub App acceptance: 6/6
• npm run check (Biome 964 files, tsgo, installer render, browser smoke)
• strict offline double pack with Node 22.23.2/npm 11.10.1; all five outputs were byte-identical
• validation used isolated fixtures/snapshots and did not mutate live consumer state

No workflow was rerun, and no release, tag, approval, or merge was performed.

Refs pylon-code/pylon#193

GPT-5.6 via Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Post-#47 preview testing safely exposed two remaining consumer-journal races: an authenticated claim can be removed while a reader still holds its inode, and a paused rotation can observe a pre-intent root handoff. The previous convergence checks did not bind removed claim bytes to an immutable identity, and a filename-only higher checkpoint could be mistaken for a real epoch advance.

Fix

• Publish new claims as canonical digest-named content plus an immutable generation index, while keeping legacy undigested claims readable but ineligible for removal convergence.
• Bind bounded async and sync reads to an exact SHA-256 anchor. The typed unlink signal now requires the same opened inode, stable bounds, a positive-to-zero link transition, final path absence, and exact anchored bytes.
• Authenticate every changed journal root with bounded canonical reads. Only one exact +1 successor can produce the typed epoch handoff.
• Authenticate in-progress next epochs against the exact latest rotation intent, while preserving exact current and retained-predecessor cleanup states.
• Keep malformed, missing, skipped, competing, symlink, replacement, modification, truncation, and I/O cases terminal.
• Sort unindexed claim validation by numeric generation and lexical digest for canonical failures.

Deterministic coverage

Coverage includes same-inode removal convergence, equal-size overwrite with restored mtime in async and sync readers, pre-intent handoff, malicious same-epoch checkpoints in hostile readdir order, sibling epoch directories, malformed/missing/skipped/competing successors, injected I/O failures, canonical unindexed-claim ordering, crash points, live temporaries, and concurrent process waves. Root-competitor tests also prove no claim, terminal, or transition publication occurs.

Verification

• node --check on both changed libraries and the publication test
• focused consumer-lock target: 1/1
• publication suite: 33/33 three times on the final tree, including two parallel runs
• release suite: 10/10
• GitHub App acceptance: 6/6
• npm run check (Biome 964 files, tsgo, installer render, browser smoke)
• strict offline double pack with Node 22.23.2/npm 11.10.1; all five outputs were byte-identical
• validation used isolated fixtures/snapshots and did not mutate live consumer state

No workflow was rerun, and no release, tag, approval, or merge was performed.

Refs pylon-code/pylon#193

GPT-5.6 via Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Post-#47 preview testing safely exposed two remaining consumer-journal races: an authenticated claim can be removed while a reader still holds its inode, and a paused rotation can observe a pre-intent root handoff. The previous convergence checks did not bind removed claim bytes to an immutable identity, and a filename-only higher checkpoint could be mistaken for a real epoch advance.

Fix

• Publish new claims as canonical digest-named content plus an immutable generation index, while keeping legacy undigested claims readable but ineligible for removal convergence.
• Bind bounded async and sync reads to an exact SHA-256 anchor. The typed unlink signal now requires the same opened inode, stable bounds, a positive-to-zero link transition, final path absence, and exact anchored bytes.
• Authenticate every changed journal root with bounded canonical reads. Only one exact +1 successor can produce the typed epoch handoff.
• Authenticate in-progress next epochs against the exact latest rotation intent, while preserving exact current and retained-predecessor cleanup states.
• Keep malformed, missing, skipped, competing, symlink, replacement, modification, truncation, and I/O cases terminal.
• Sort unindexed claim validation by numeric generation and lexical digest for canonical failures.

Deterministic coverage

Coverage includes same-inode removal convergence, equal-size overwrite with restored mtime in async and sync readers, pre-intent handoff, malicious same-epoch checkpoints in hostile readdir order, sibling epoch directories, malformed/missing/skipped/competing successors, injected I/O failures, canonical unindexed-claim ordering, crash points, live temporaries, and concurrent process waves. Root-competitor tests also prove no claim, terminal, or transition publication occurs.

Verification

• node --check on both changed libraries and the publication test
• focused consumer-lock target: 1/1
• publication suite: 33/33 three times on the final tree, including two parallel runs
• release suite: 10/10
• GitHub App acceptance: 6/6
• npm run check (Biome 964 files, tsgo, installer render, browser smoke)
• strict offline double pack with Node 22.23.2/npm 11.10.1; all five outputs were byte-identical
• validation used isolated fixtures/snapshots and did not mutate live consumer state

No workflow was rerun, and no release, tag, approval, or merge was performed.

Refs pylon-code/pylon#193

GPT-5.6 via Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Post-#47 preview testing safely exposed two remaining consumer-journal races: an authenticated claim can be removed while a reader still holds its inode, and a paused rotation can observe a pre-intent root handoff. The previous convergence checks did not bind removed claim bytes to an immutable identity, and a filename-only higher checkpoint could be mistaken for a real epoch advance.

Fix

• Publish new claims as canonical digest-named content plus an immutable generation index, while keeping legacy undigested claims readable but ineligible for removal convergence.
• Bind bounded async and sync reads to an exact SHA-256 anchor. The typed unlink signal now requires the same opened inode, stable bounds, a positive-to-zero link transition, final path absence, and exact anchored bytes.
• Authenticate every changed journal root with bounded canonical reads. Only one exact +1 successor can produce the typed epoch handoff.
• Authenticate in-progress next epochs against the exact latest rotation intent, while preserving exact current and retained-predecessor cleanup states.
• Keep malformed, missing, skipped, competing, symlink, replacement, modification, truncation, and I/O cases terminal.
• Sort unindexed claim validation by numeric generation and lexical digest for canonical failures.

Deterministic coverage

Coverage includes same-inode removal convergence, equal-size overwrite with restored mtime in async and sync readers, pre-intent handoff, malicious same-epoch checkpoints in hostile readdir order, sibling epoch directories, malformed/missing/skipped/competing successors, injected I/O failures, canonical unindexed-claim ordering, crash points, live temporaries, and concurrent process waves. Root-competitor tests also prove no claim, terminal, or transition publication occurs.

Verification

• node --check on both changed libraries and the publication test
• focused consumer-lock target: 1/1
• publication suite: 33/33 three times on the final tree, including two parallel runs
• release suite: 10/10
• GitHub App acceptance: 6/6
• npm run check (Biome 964 files, tsgo, installer render, browser smoke)
• strict offline double pack with Node 22.23.2/npm 11.10.1; all five outputs were byte-identical
• validation used isolated fixtures/snapshots and did not mutate live consumer state

No workflow was rerun, and no release, tag, approval, or merge was performed.

Refs pylon-code/pylon#193

GPT-5.6 via Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Post-#47 preview testing safely exposed two remaining consumer-journal races: an authenticated claim can be removed while a reader still holds its inode, and a paused rotation can observe a pre-intent root handoff. The previous convergence checks did not bind removed claim bytes to an immutable identity, and a filename-only higher checkpoint could be mistaken for a real epoch advance.

Fix

• Publish new claims as canonical digest-named content plus an immutable generation index, while keeping legacy undigested claims readable but ineligible for removal convergence.
• Bind bounded async and sync reads to an exact SHA-256 anchor. The typed unlink signal now requires the same opened inode, stable bounds, a positive-to-zero link transition, final path absence, and exact anchored bytes.
• Authenticate every changed journal root with bounded canonical reads. Only one exact +1 successor can produce the typed epoch handoff.
• Authenticate in-progress next epochs against the exact latest rotation intent, while preserving exact current and retained-predecessor cleanup states.
• Keep malformed, missing, skipped, competing, symlink, replacement, modification, truncation, and I/O cases terminal.
• Sort unindexed claim validation by numeric generation and lexical digest for canonical failures.

Deterministic coverage

Coverage includes same-inode removal convergence, equal-size overwrite with restored mtime in async and sync readers, pre-intent handoff, malicious same-epoch checkpoints in hostile readdir order, sibling epoch directories, malformed/missing/skipped/competing successors, injected I/O failures, canonical unindexed-claim ordering, crash points, live temporaries, and concurrent process waves. Root-competitor tests also prove no claim, terminal, or transition publication occurs.

Verification

• node --check on both changed libraries and the publication test
• focused consumer-lock target: 1/1
• publication suite: 33/33 three times on the final tree, including two parallel runs
• release suite: 10/10
• GitHub App acceptance: 6/6
• npm run check (Biome 964 files, tsgo, installer render, browser smoke)
• strict offline double pack with Node 22.23.2/npm 11.10.1; all five outputs were byte-identical
• validation used isolated fixtures/snapshots and did not mutate live consumer state

No workflow was rerun, and no release, tag, approval, or merge was performed.

Refs pylon-code/pylon#193

GPT-5.6 via Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}