fix(publication): recover durable generation journals

.github/workflows/ci.yml

@@ -339,6 +339,71 @@ jobs:
       - name: Verify temporary-prefix runtime
         run: npm run release:pylon:smoke
 
+  pylon-publication:
+    name: Pylon publication (${{ matrix.os }})
+    needs: trust
+    if: needs.trust.outputs.allowed == 'true'
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-15]
+    steps:
+      - name: Checkout exact source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ inputs.checkout_ref || github.ref }}
+          persist-credentials: false
+
+      - name: Setup pinned Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.23.2
+
+      - name: Install test dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Record source identity
+        run: |
+          mkdir -p publication-evidence
+          git rev-parse HEAD > publication-evidence/commit.txt
+          git rev-parse 'HEAD^{tree}' > publication-evidence/tree.txt
+          node --version > publication-evidence/node.txt
+
+      - name: Complete retained and current-public contract suite
+        shell: bash
+        run: |
+          set -o pipefail
+          npm run test:pylon-publication 2>&1 | tee publication-evidence/publication.log
+
+      - name: Repeated process stress and read handoffs
+        shell: bash
+        run: |
+          set -o pipefail
+          npm run test:pylon-publication-stress 2>&1 | tee publication-evidence/stress.log
+
+      - name: Every captured-process crash boundary
+        shell: bash
+        run: |
+          set -o pipefail
+          npm run test:pylon-publication-crash 2>&1 | tee publication-evidence/crash.log
+
+      - name: Actual 16 MiB maximum, serialized after complete suite
+        shell: bash
+        run: |
+          set -o pipefail
+          npm run test:pylon-publication-maximum 2>&1 | tee publication-evidence/maximum.log
+
+      - name: Retain exact-source verification evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pylon-publication-${{ matrix.os }}
+          path: publication-evidence
+          if-no-files-found: error
+          retention-days: 7
+
   build-check-test:
     name: build-check-test
     if: always() && (needs.trust.outputs.allowed == 'true' || inputs.require_trusted)
@@ -350,6 +415,7 @@ jobs:
       - pylon-artifact-pack
       - pylon-artifact-reproducibility
       - pylon-artifact-install
+      - pylon-publication
     runs-on: ubuntu-latest
     steps:
       - name: Verify CI results
@@ -360,6 +426,7 @@ jobs:
           WINDOWS_OWNED_SESSION_RESULT: ${{ needs.owned-session-contract-windows.result }}
           ARTIFACT_PACK_RESULT: ${{ needs.pylon-artifact-pack.result }}
           ARTIFACT_REPRODUCIBILITY_RESULT: ${{ needs.pylon-artifact-reproducibility.result }}
+          PUBLICATION_RESULT: ${{ needs.pylon-publication.result }}
           ARTIFACT_INSTALL_RESULT: ${{ needs.pylon-artifact-install.result }}
         run: |
           test "$TRUST_ALLOWED" = true
@@ -369,3 +436,4 @@ jobs:
           test "$ARTIFACT_PACK_RESULT" = success
           test "$ARTIFACT_REPRODUCIBILITY_RESULT" = success
           test "$ARTIFACT_INSTALL_RESULT" = success
+          test "$PUBLICATION_RESULT" = success

.pylon/features.yaml

@@ -404,12 +404,13 @@ decisions:
     area: distribution
     state: candidate
     owner: pylon-fork
-    decision: retain
+    decision: redesign
     pylon_refs:
       - https://github.com/pylon-code/prime-agent/issues/29
+      - https://github.com/pylon-code/prime-agent/issues/53
     upstream_refs:
       - https://github.com/PrimeIntellect-ai/prime-agent/pull/32
-    fork_change: protected-preview-and-append-only-stable-publication-v1
+    fork_change: protected-publication-with-inode-bound-consumer-generations-v3
     upstream_support: Prime's inherited publication path targets upstream R2 and npm channels and does not provide canonical Pylon-only exact-SHA admission, six immutable preview subjects, byte-preserving manual promotion, signed monotonic stable history, or append-only withdrawal.
     revisit_when:
       - Prime ships a repository-neutral immutable release and promotion primitive that preserves Pylon's exact source, workflow, attestation, stable-history, and withdrawal policy without upstream credentials or channel names.

.pylon/upstream-review.md

@@ -292,3 +292,13 @@ Follow-up: Task10 builds/packs the exact merged tree into a private prefix and r
 - Wire classification: **backward-compatible optional metadata under the existing `event_sequence` capability**. Protocol remains 7; revision is 33 and the independently checked identity is `protocol-7-schema-33-5924c5b19b8b`. Existing command/event compatibility remains unchanged because the underlying events still work without replay fields. No new capability, SDK feature token, command, or startup requirement is introduced. Session/transfer identity, attachment epochs, owner and exact-environment checks remain intact.
 - Validation: nine focused files passed 673 tests with no skips or failures, including daemon/protocol/supervisor/SDK, caller-owned contract, snapshot-cache and transfer containment. The new 14-case regression suite exercises the real worker replay calculation, supervisor framing/cache and SDK commits with faux-provider messages and private agent homes. It covers absent/old-peer metadata, complete/partial/unavailable status, malformed coordinates, session identity and stale assemblies. Removing propagation gives six expected failures; restoring the old synthetic-complete cache behavior also fails the cache regression. `npm run check` passes formatting/lint, TypeScript, installer and browser-bundle checks.
 - Final private packaging, live Pylon continuity/follow-up/Stop/restart proof and checkpoint review remain Task10 gates. This fix does not claim to resolve the separately observed Pylon teardown timeouts. Revisit when upstream provides the same worker-issued replay propagation without weakening continuity or stock fallback.
+
+## 2026-09-11 — bounded publication consumer generations
+
+- Reviewed upstream remains `1eee2938b4eeb7a4d72e17035adda669a89b63de` (v0.9.4). This distribution change resolves the filesystem-authority defects documented in [#53](https://github.com/pylon-code/prime-agent/issues/53); it does not advance the frozen upstream range or restore upstream R2/npm publication.
+- `protected-pylon-publication`: **redesign** the local consumer journal as v3 generations while retaining the protected preview/stable workflow policies. The public JSON projection and signed manifest formats are unchanged. A receipted creation identity selects one root; complete hidden generations publish by one directory rename. Exact predecessor claim/index, tip, inode and retirement-certificate commitments govern successor admission and bounded cleanup through deletion of the last proof link.
+- Migration requires explicit external legacy-process quiescence and API/CLI acknowledgement before mutation. It authenticates all five historical source families, installs the old-client-visible impossible-generation blocker before the guard/source retirement sequence, preserves original v1 inodes at exact 0500, retains the exact v2 source for provenance, and revalidates canonical completion. A foreign old-client bootstrap inode in the retirement gap is a conflict. Concurrent helpers may join independently authenticated winners; injected errors and unsafe pinned observations remain terminal.
+- Interrupted receipt and guard joins complete and revalidate their canonical/staging directory fsync barriers before dependent publication or source retirement. Async and sync supplied openers preserve their original errors, including ELOOP/EISDIR; only direct native errors receive unsafe-path classification. Focused ordering regressions cover interrupted, concurrent and raced helpers, and the crash inventory includes missing nested parents. Repeated stress preserves exact prior history prefixes and cumulative acknowledged/returned values across all ten rounds.
+- Callback staging never publishes before successful return. Exact canonical receipt inodes permit interrupted publication recovery without replaying callbacks. Rotation recovery reconstructs the pre-certificate source when its deterministic rotation claim was linked before the winning index CAS; it excludes only that exact claim and still requires the complete certificate and winning-CAS successor checks. A claim that consumes the remaining heartbeat admission margin is released and rotated before callback entry, preserving recovery at small supported state limits.
+- Verification gates retain the protected and historical v2 matrices alongside current-public v3 verifier tests, complete mutation-boundary SIGKILL traces with fresh-process recovery, repeated four-process migration/rotation competition, pinned-read handoffs and last-proof replacement negatives. CI requires separate retained/current-public, exhaustive crash and repeated stress suites followed sequentially by the actual 16 MiB maximum on Ubuntu 24.04 and macOS 15 under Node 22.23.2; both results are mandatory in `build-check-test`. Process crashes do not simulate physical power loss, and resource limits are separately bounded historical inventories, metadata and generation-journal budgets.
+- Revisit only when an upstream primitive preserves these exact local authority, bounded-work, migration and no-replay guarantees. Publication still requires current exact-source checks, independent review and every existing protected environment approval; filesystem tests do not authorize a release.