fix(publication): complete concurrent rotation handoff

[rynfar]

Problem

Hosted publication can retire a checkpoint's temporary hardlink between the path stat and the checkpoint open. The bytes and inode remain valid, but the bounded reader previously treated the nlink 2 -> 1 transition as an arbitrary mutation.

A second rotation writer can also lose the claim-index EEXIST race while the winning writer has durably published the exact next epoch directory but has not published its checkpoint yet. That exact T,C1,E1,E2(empty),no C2 root is a valid incomplete handoff, but claim publication revalidation lacked the authenticated rotation checkpoint needed to recognize it.

Fix

• Emit typed, digest-bound evidence for the exact pre-open checkpoint hardlink transition without relaxing normal stat equality.
• Authenticate link-retired checkpoints with one stable-root proof, including both known and discovered incomplete-root early exits.
• Derive an exact in-progress checkpoint only from a fully validated, byte-exact rotation claim and propagate it through claim metadata publication, including post-EEXIST revalidation.
• Keep malformed evidence, competing checkpoints, altered source/anchor/history fields, nonrotation claims, and unstable roots fail closed.

Verification

• Focused deterministic barrier test: 5 repeated passes
• 12-wave consumer-lock stress: 5 passes, 60 child waves total
• Publication suite: 35/35 twice sequentially and 35/35 twice in parallel
• Release suite: 10/10
• Ruleset auditor App suite: 6/6
• npm run check
• Final review: clean

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Hosted publication can retire a checkpoint's temporary hardlink between the path stat and the checkpoint open. The bytes and inode remain valid, but the bounded reader previously treated the nlink 2 -> 1 transition as an arbitrary mutation.

A second rotation writer can also lose the claim-index EEXIST race while the winning writer has durably published the exact next epoch directory but has not published its checkpoint yet. That exact T,C1,E1,E2(empty),no C2 root is a valid incomplete handoff, but claim publication revalidation lacked the authenticated rotation checkpoint needed to recognize it.

Fix

• Emit typed, digest-bound evidence for the exact pre-open checkpoint hardlink transition without relaxing normal stat equality.
• Authenticate link-retired checkpoints with one stable-root proof, including both known and discovered incomplete-root early exits.
• Derive an exact in-progress checkpoint only from a fully validated, byte-exact rotation claim and propagate it through claim metadata publication, including post-EEXIST revalidation.
• Keep malformed evidence, competing checkpoints, altered source/anchor/history fields, nonrotation claims, and unstable roots fail closed.

Verification

• Focused deterministic barrier test: 5 repeated passes
• 12-wave consumer-lock stress: 5 passes, 60 child waves total
• Publication suite: 35/35 twice sequentially and 35/35 twice in parallel
• Release suite: 10/10
• Ruleset auditor App suite: 6/6
• npm run check
• Final review: clean

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Hosted publication can retire a checkpoint's temporary hardlink between the path stat and the checkpoint open. The bytes and inode remain valid, but the bounded reader previously treated the nlink 2 -> 1 transition as an arbitrary mutation.

A second rotation writer can also lose the claim-index EEXIST race while the winning writer has durably published the exact next epoch directory but has not published its checkpoint yet. That exact T,C1,E1,E2(empty),no C2 root is a valid incomplete handoff, but claim publication revalidation lacked the authenticated rotation checkpoint needed to recognize it.

Fix

• Emit typed, digest-bound evidence for the exact pre-open checkpoint hardlink transition without relaxing normal stat equality.
• Authenticate link-retired checkpoints with one stable-root proof, including both known and discovered incomplete-root early exits.
• Derive an exact in-progress checkpoint only from a fully validated, byte-exact rotation claim and propagate it through claim metadata publication, including post-EEXIST revalidation.
• Keep malformed evidence, competing checkpoints, altered source/anchor/history fields, nonrotation claims, and unstable roots fail closed.

Verification

• Focused deterministic barrier test: 5 repeated passes
• 12-wave consumer-lock stress: 5 passes, 60 child waves total
• Publication suite: 35/35 twice sequentially and 35/35 twice in parallel
• Release suite: 10/10
• Ruleset auditor App suite: 6/6
• npm run check
• Final review: clean

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Hosted publication can retire a checkpoint's temporary hardlink between the path stat and the checkpoint open. The bytes and inode remain valid, but the bounded reader previously treated the nlink 2 -> 1 transition as an arbitrary mutation.

A second rotation writer can also lose the claim-index EEXIST race while the winning writer has durably published the exact next epoch directory but has not published its checkpoint yet. That exact T,C1,E1,E2(empty),no C2 root is a valid incomplete handoff, but claim publication revalidation lacked the authenticated rotation checkpoint needed to recognize it.

Fix

• Emit typed, digest-bound evidence for the exact pre-open checkpoint hardlink transition without relaxing normal stat equality.
• Authenticate link-retired checkpoints with one stable-root proof, including both known and discovered incomplete-root early exits.
• Derive an exact in-progress checkpoint only from a fully validated, byte-exact rotation claim and propagate it through claim metadata publication, including post-EEXIST revalidation.
• Keep malformed evidence, competing checkpoints, altered source/anchor/history fields, nonrotation claims, and unstable roots fail closed.

Verification

• Focused deterministic barrier test: 5 repeated passes
• 12-wave consumer-lock stress: 5 passes, 60 child waves total
• Publication suite: 35/35 twice sequentially and 35/35 twice in parallel
• Release suite: 10/10
• Ruleset auditor App suite: 6/6
• npm run check
• Final review: clean

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Hosted publication can retire a checkpoint's temporary hardlink between the path stat and the checkpoint open. The bytes and inode remain valid, but the bounded reader previously treated the nlink 2 -> 1 transition as an arbitrary mutation.

A second rotation writer can also lose the claim-index EEXIST race while the winning writer has durably published the exact next epoch directory but has not published its checkpoint yet. That exact T,C1,E1,E2(empty),no C2 root is a valid incomplete handoff, but claim publication revalidation lacked the authenticated rotation checkpoint needed to recognize it.

Fix

• Emit typed, digest-bound evidence for the exact pre-open checkpoint hardlink transition without relaxing normal stat equality.
• Authenticate link-retired checkpoints with one stable-root proof, including both known and discovered incomplete-root early exits.
• Derive an exact in-progress checkpoint only from a fully validated, byte-exact rotation claim and propagate it through claim metadata publication, including post-EEXIST revalidation.
• Keep malformed evidence, competing checkpoints, altered source/anchor/history fields, nonrotation claims, and unstable roots fail closed.

Verification

• Focused deterministic barrier test: 5 repeated passes
• 12-wave consumer-lock stress: 5 passes, 60 child waves total
• Publication suite: 35/35 twice sequentially and 35/35 twice in parallel
• Release suite: 10/10
• Ruleset auditor App suite: 6/6
• npm run check
• Final review: clean

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Hosted publication can retire a checkpoint's temporary hardlink between the path stat and the checkpoint open. The bytes and inode remain valid, but the bounded reader previously treated the nlink 2 -> 1 transition as an arbitrary mutation.

A second rotation writer can also lose the claim-index EEXIST race while the winning writer has durably published the exact next epoch directory but has not published its checkpoint yet. That exact T,C1,E1,E2(empty),no C2 root is a valid incomplete handoff, but claim publication revalidation lacked the authenticated rotation checkpoint needed to recognize it.

Fix

• Emit typed, digest-bound evidence for the exact pre-open checkpoint hardlink transition without relaxing normal stat equality.
• Authenticate link-retired checkpoints with one stable-root proof, including both known and discovered incomplete-root early exits.
• Derive an exact in-progress checkpoint only from a fully validated, byte-exact rotation claim and propagate it through claim metadata publication, including post-EEXIST revalidation.
• Keep malformed evidence, competing checkpoints, altered source/anchor/history fields, nonrotation claims, and unstable roots fail closed.

Verification

• Focused deterministic barrier test: 5 repeated passes
• 12-wave consumer-lock stress: 5 passes, 60 child waves total
• Publication suite: 35/35 twice sequentially and 35/35 twice in parallel
• Release suite: 10/10
• Ruleset auditor App suite: 6/6
• npm run check
• Final review: clean

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Hosted publication can retire a checkpoint's temporary hardlink between the path stat and the checkpoint open. The bytes and inode remain valid, but the bounded reader previously treated the nlink 2 -> 1 transition as an arbitrary mutation.

A second rotation writer can also lose the claim-index EEXIST race while the winning writer has durably published the exact next epoch directory but has not published its checkpoint yet. That exact T,C1,E1,E2(empty),no C2 root is a valid incomplete handoff, but claim publication revalidation lacked the authenticated rotation checkpoint needed to recognize it.

Fix

• Emit typed, digest-bound evidence for the exact pre-open checkpoint hardlink transition without relaxing normal stat equality.
• Authenticate link-retired checkpoints with one stable-root proof, including both known and discovered incomplete-root early exits.
• Derive an exact in-progress checkpoint only from a fully validated, byte-exact rotation claim and propagate it through claim metadata publication, including post-EEXIST revalidation.
• Keep malformed evidence, competing checkpoints, altered source/anchor/history fields, nonrotation claims, and unstable roots fail closed.

Verification

• Focused deterministic barrier test: 5 repeated passes
• 12-wave consumer-lock stress: 5 passes, 60 child waves total
• Publication suite: 35/35 twice sequentially and 35/35 twice in parallel
• Release suite: 10/10
• Ruleset auditor App suite: 6/6
• npm run check
• Final review: clean

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rynfar]

Problem

Hosted publication can retire a checkpoint's temporary hardlink between the path stat and the checkpoint open. The bytes and inode remain valid, but the bounded reader previously treated the nlink 2 -> 1 transition as an arbitrary mutation.

A second rotation writer can also lose the claim-index EEXIST race while the winning writer has durably published the exact next epoch directory but has not published its checkpoint yet. That exact T,C1,E1,E2(empty),no C2 root is a valid incomplete handoff, but claim publication revalidation lacked the authenticated rotation checkpoint needed to recognize it.

Fix

• Emit typed, digest-bound evidence for the exact pre-open checkpoint hardlink transition without relaxing normal stat equality.
• Authenticate link-retired checkpoints with one stable-root proof, including both known and discovered incomplete-root early exits.
• Derive an exact in-progress checkpoint only from a fully validated, byte-exact rotation claim and propagate it through claim metadata publication, including post-EEXIST revalidation.
• Keep malformed evidence, competing checkpoints, altered source/anchor/history fields, nonrotation claims, and unstable roots fail closed.

Verification

• Focused deterministic barrier test: 5 repeated passes
• 12-wave consumer-lock stress: 5 passes, 60 child waves total
• Publication suite: 35/35 twice sequentially and 35/35 twice in parallel
• Release suite: 10/10
• Ruleset auditor App suite: 6/6
• npm run check
• Final review: clean

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}