Signed firmware candidates had no verification/staging path. Add an exclusive offline candidate directory verified by the pinned TUF client, strict signed bench compatibility and an explicit externally trusted release floor. Native updates:stage and updates:inspect commands share this with the compiled CLI; inspection re-authenticates metadata and actual image bytes against caller-supplied trust rather than trusting a receipt. Canonical key-object identifiers, positive safe metadata versions and real UTC expiration dates are checked before SDK admission.
The module never executes, flashes or selects firmware. Persistent protected metadata/release floors, enrollment operations, interruption-safe installation and known-good rollback remain open in #42 and parent #9. The diagnostic update/rollback gate remains blocked.
Validation for final source 0a354d6378c674a0d3d29d44c120d6e8658b1c12: 18 focused tests pass with 126 assertions; app/runtime/view types and Pickier pass; portable compiled stage/inspect and raised-floor rejection work outside the checkout; docs build, roadmap and parity checks pass. Independent Spec and Standards reviews found no remaining actionable findings after regressions and fixes for mutable admission policy, noncanonical key identifiers and invalid metadata dates/versions. The initial 27-test diagnostics/update qualification had four timeouts and remains retained, with no claimed cause or increased existing budgets. Both earlier feature CI runs were cancelled for necessary source corrections. Full exact-head CI 39641949569 passed all five jobs. The native application suite reports 1,395 passes, 39 skips, zero failures and 488,273 assertions across 1,434 tests. Firmware, both native browser scenarios and isolated purge qualification also passed. This exact commit was published to origin/main by a normal fast-forward as Chris, without coauthors; GitHub records this PR merged on 2026-10-21.
Refs #9