[dougchansan]

What this PR adds

A separate, verified installer for alula's switch-artemis-launcher, plus the 2026-11-01 hardware report. It does not modify the existing payload installer (kit entry 4) or the Seedsow Lua Editor entry (kit entry 5), and it does not touch the upstream Lua.

The launcher is downloaded at install time from a pinned revision (b9e6de8, tag v1), every file is checked against a recorded SHA-256, and nothing third-party is vendored.

Final review round — restore staging path

Restore staging path (P1). Both restore paths staged save9999.dat beside a
manifest whose local is relative, then invoked save-write-stage.cjs without a
cwd; the writer resolves entry.local with fs.readFile against its process
directory, so restore could read the wrong file or fail. stageTriggerForRestore()
now writes the trigger + manifest, and writeRestoreTrigger() invokes the writer
with cwd=<staging> and removes the directory in a finally (success, failure,
exception). Both modern and legacy paths use it.

Tests: 47 installer + 14 delete-result = 157 Node assertions on this branch.
A faithful writer mock is spawned from the captured cwd to prove the staged
trigger is read; the same invocation from an unrelated directory fails with
ENOENT (the old bug). Also covers modern/migrated/legacy staging, missing and
altered triggers, writer failure propagation, cleanup, and backup/baseline
preservation.

CI: added .github/workflows/offline-tests.yml (Node 20, Python 3.11, Lua 5.4,
shell). The initial run failed because the tests use Lua 5.2+ load(string);
the workflow now installs/runs Lua 5.4 and both PRs' latest checks pass.

Final review round

1. Migrated legacy restore now works (P1). restoreFromOriginal() required
   identity-bearing backups, so a successful migrate-legacy could not be
   restored. New loadOriginalBackupForRestore() has two narrow paths:
   • modern: full title/account identity plus every existing backup check;
   • migrated: the identity-less legacy backup is accepted only when its
     manifest SHA-256 and trigger equal the immutable original record, the
     record's title/account match, the installed payload equals the pinned
     release, the trigger equals a freshly recomputed deterministic
     transformation, and the attestation names the same backup, trigger,
     installed-snapshot manifest, identity evidence and pinned commit.
     Any mismatch is refused (exit 6); identity is never invented and the backup
     is never modified. Covered by positive and 9 negative tests (missing
     attestation, empty evidence, wrong account/title, changed file, changed
     manifest, changed trigger, wrong pinned hash, wrong attestation trigger).
2. Delete success requires an explicit commit (P2). decideDelete() no
   longer returns success for a deleted file when commitResult is missing.
   Success = DeleteFile 0, explicit Commit 0, verified-absent read-back;
   missing commit is commit-missing (exit 1). Already-absent needs a verified
   read-back and no commit. 0x202 remains the canonical not-found code; bare
   0x2 and unknown codes fail closed. Tests cover missing/failed commit,
   failed read-back, unknown result and already-absent.
3. Restore ownership follows the record. restoreTarget() deletes only
   entries recorded as add; a non-trigger replace is no longer silently
   removed. Added a full lifecycle test (fresh -> reinstall no-op -> update ->
   interrupted update -> restore preflight -> restore -> verify) and a
   malformed-legacy-receipt refusal test.

Test totals on this branch: 43 installer + 14 delete-result = 153 Node
assertions, Python 8, Lua 13 + 12.

Second review round

Four follow-up findings are fixed on this head:

1. Immutable original rollback baseline. Records are now split into an
   immutable ORIGINAL (pre-first-install state, written with create-if-absent)
   and per-attempt TRANSACTIONS. A reinstall pulls the live save, no-ops when
   every staged byte already matches, otherwise writes an update transaction;
   the original and its backup are never rewritten. First install refuses a
   post-install snapshot as the baseline and writes the original before the
   console transaction. Restore targets the pre-first-install state, matches
   the live save against every recorded state, refuses modified files and
   resumes after partial deletes. Legacy single receipts are copied into the
   original record, not replaced by a newer snapshot.
2. Conservative legacy migration. New migrate-legacy: validates the
   original backup, verifies the installed files against the pinned release and
   the installed trigger against the deterministic retarget of the original
   trigger, requires independently verified identity (identity-bearing pull or
   local config/uids.json; never the truncated archive uid), and writes an
   immutable original record plus attestation. The original backup is read-only.
3. Filesystem result encoding. The canonical FS not-found result is 0x202
   (module 1, description 2), which domain.cjs returns as canonicalResult
   and save-write-stage.cjs compares. A bare 0x2 is now unknown and fails
   closed; delete still cannot report success without commit 0 and a verified
   read-back/inventory.
4. Legacy staging adoption. Unmarked staging directories from older
   versions are adopted only when they contain exactly the expected files,
   every launcher file matches the pinned release and the trigger parses as our
   retarget. Adoption writes the marker; it never deletes or overwrites
   unrelated content.

Review fixes in this revision

P1 — unsafe staging deletion

stagePackage() used to rm -rf a caller-supplied --out. Staging now:

• lives only under <repo>/staging or the OS temp dir; the repo root, home, /, and unrelated existing directories are refused;
• only replaces a directory that carries .artemis-staging.json for the same title;
• builds in a marked sibling and promotes with rename(); a failed build discards only that sibling and leaves the previous payload and manifest byte-identical;
• refuses symlinked targets and symlinked parents that escape the allowed roots.

P1 — rollback file ownership

Installs now write a local installation receipt before the console transaction:

• full title id and 32-hex account uid, backup path + manifest SHA-256 + entry count + trigger SHA-256 + archive identity, pinned upstream commit;
• every installed path with SHA-256, size and kind: add|replace, plus the original hash for the replaced trigger;
• status (installing/installed/install-failed/restoring/restored/restore-failed) and restore progress (trigger, deleted[]);
• stored at ~/.local/state/ns2-savekit/artemis-launcher/receipts/ (0700, files 0600), override ARTEMIS_STATE; never committed.

Restore pulls the live save first and refuses to delete a file whose live hash differs from the receipt, is missing, is an unowned launcher-named file, or whose trigger is not the expected one. Deletions update the receipt so an interrupted restore resumes safely.

Installs made before receipts use a conservative --adopt-legacy path: ownership must be established from pinned content (live files equal the pinned upstream bytes, live trigger equals the deterministic retarget of the backup). No receipt data is fabricated. Without that, destructive cleanup is refused.

P1 — backup integrity

tools/lib/artemis-backup.cjs validates before any console operation, for stage/install/verify/restore:

• manifest parses; entries non-empty; partial false; failed empty; files/bytes consistent; paths safe and unique; every file is a regular non-symlink whose size and SHA-256 match; the trigger exists and matches;
• install/verify/restore require the full 16-hex program id and 32-hex account uid and compare them with --title/--uid;
• the truncated uid=… in the human-readable archive line is explicitly not identity.

save-pull-root.cjs now writes programId, uid, space, type, rank and index into new manifests.

P2 — delete failure propagation

save-delete-root.cjs now classifies the canonical DeleteFile result and feeds it to a pure decideDelete({fsResult, commitResult, stillPresent}):

• skips the commit on a refused delete;
• cannot return success without commit 0 and a verified-absent reopen;
• reopens the file read-only and checks the root directory listing, so a failed open cannot be mistaken for absence;
• distinct non-zero codes: 10 already absent, 11 refused/still present, 12 commit failed, 3/4 transport.

Restore treats 10 as already done and stops on anything else. Tests cover refused deletes, commit failures, a contradicting not-found, still-present files, and the refusal to claim success before verification.

Tests

• tests/test_artemis_launcher.cjs: 47 passed (was 14) — staging paths/symlinks/interrupted builds, corrupt and legacy backups, identity, receipts, modified/missing/unexpected files, partial restore resume (including the delete/receipt and trigger/receipt crash windows), post-restore check, editor/ns2jb compatibility, repeated install over the exact pinned bytes, repeated restore, authorization, unsupported titles.
• tests/test_delete_result.cjs: 14 passed.
• Existing suites: 12 other Node files (103 assertions), Python 8, Lua 13 + 12, shell 3 — all pass. (132 Node assertions total across 14 files.)

Docs

• fixed the transcript link (.log → committed .txt);
• removed the “always option 8” claim — the kit menu is conditional, so the docs say to read the label and show both layouts;
• documented receipt format/location, backup integrity, staging rules, conflicts, interrupted restore/resume, --adopt-legacy, and the removed inject2.lua/inject2-ran.txt test files with safe cleanup commands;
• attribution to alula, Proggy/Tristan Grimmer and upstream's credits is unchanged.

Stage-2 investigation (2026-11-02)

Instead of retrying blindly, the acquisition failures were analyzed with the new
read-only tools/diagnose-ns2jb-acquisition.cjs:

• 52 historical successes and 177 failures; the 2026-11-01 successes used the
  same engine hash (b989e4adafa2) and identical host files as the failures.
• No SD card; save on internal storage (pin cost 13616); host is Wi-Fi-only,
  while upstream requires Ethernet.
• A deterministic defect was proven: the local engine predates upstream
  81d5bb1's qualifyOverlap. Replaying the 30 recorded extent-present
  waves, the old allPending test rejects 30/30; the upstream predicate accepts
  27/30.
• An isolated host with that fix advanced past extent requalification
  (qualifiedReadSize set) but then missed the canary. Three controlled
  attempts were made; the console was recovered to HOME after each and no save
  was written.

Details and the next experiments are in
docs/NS2JB-STAGE2-RELIABILITY.md. H0–H12 remain BLOCKED.

Hardware rollback validation — BLOCKED

The destructive rollback path has not been run on hardware. On 2026-11-02,
three controlled ns2jb acquisitions (one session per boot, nine-argument
V=START, no --keep-open, cold boot each time) failed at stage 2/4 before any
save operation:

1. The bounded native leak contains no qualified, encodable link candidate
2. The planned bucket period did not qualify on this candidate
3. General-heap allocation changed while the cache was retained; stop overwrites and recover

No save write was attempted, the console was recovered to HOME after each
attempt, and the existing Artemis installation is intact. Consequently the
restore dry-run never ran on hardware, no destructive restore was authorized,
and the migrated-legacy hardware path was not exercised.

docs/ARTEMIS-ROLLBACK-HARDWARE.md records the sanitized H0–H12 matrix, the
failure messages, the offline coverage that protects these paths, and the exact
hardware steps still required. This PR does not claim hardware rollback
validation.

Hardware validation

The original 2026-11-01 run still stands: firmware 23.0.1, Seedsow Lullaby Demo 1.0.0, upstream b9e6de8; launcher screen, Hello World, HTTP /status + /eval, save upload/delete, close/relaunch and cold-boot persistence all passed. Backup 290 files / 4,665,778 B; install 7 files / 104,236 B; post-install pull 6 added, 1 replaced, 289 unchanged.

For this revision, no live RPC session could be obtained. Six fresh-boot acquisitions failed at ns2jb stage 2/4, each with a different timing miss:

1. Native batch did not terminate; resources retained
2. Clean alias did not qualify within its attempt limit
3. The bounded native leak contains no qualified, encodable link
4. General-heap allocation changed while the cache was retained
5. Overwrite missed the qualified canary
6. Native batch did not terminate; resources retained

A further attempt used NS2_TMP_FALLBACK=1 after a fresh power cycle; the tmp mount was above the fallback threshold, so that was not the cause. The 5-argument V=START was also tried and rejected by the console (Wrong number of arguments); the 9-argument form is required. No save operation was issued in any attempt, so nothing on the console changed; it was restored to HOME by a power cycle.

What was re-validated on hardware without a session (2026-11-01 22:32): the installed launcher boots, persists across close/relaunch, and its HTTP server answers /status (200), /eval (hello world, Lua 5.1, Ounce), a uniquely named save file written/read/deleted, and the protected-file and path-traversal refusals. All seven installed files hash identically to the staged payload (transcript section 9). A further /eval check at 22:50 confirmed the recovery-test files inject2.lua and inject2-ran.txt are absent from the live save while core.lua is present (transcript section 10).

The legacy migration path was then exercised on the real installation without RPC: an explicit-file HTTP snapshot (9 files, 114,443 bytes) plus the pre-install backup and the local account mapping produced an immutable original record (written to a test ARTEMIS_STATE directory; run the same migrate-legacy command without that override to persist it locally). The installed trigger verified as the deterministic retarget of the original trigger (d149d71b… -> ca472410…), the pre-install backup's manifest SHA-256 was unchanged before and after, and wrong-account/tampered-payload attempts were refused with exit 6. Receipt-driven restore, modified-file refusal and delete propagation remain offline-only until a live RPC session is available.

Compatibility implications

• New installs need an identity-bearing backup; the current save-pull-root.cjs produces one. Legacy backups are still readable/stageable but cannot authorize a write or restore.
• The existing Seedsow install predates receipts, so its rollback uses --adopt-legacy (content-checked) rather than a receipt.
• Kit entry numbers move with conditional entries; the docs no longer promise “8”.
• Existing launchers: entry 4 and the editor entry are untouched; editor/ns2jb files are not overwritten. Both launchers still share save9999.dat, so boot ownership remains exclusive by design.

Outstanding limitations

• Receipt-driven restore/delete and modified-file refusal are not hardware-proven in this revision (no session). Nora 2 remains offline-only.
• Startup minus update bypass still does not trigger on demo 1.0.0 (unchanged finding).
• HTTP server remains unauthenticated on TCP 8080; trusted LAN only.

Not merged, not draft. Base is main.