Metadata refresh needs to retain accepted trust advancement even when a later phase fails. Add an independently pinned host protocol store that journals inputs before SDK delivery, commits each verified metadata prefix before disposable cache writes, and retains release and clock floors across restarts. Root-authorized timestamp/snapshot authority changes start a new active epoch while preserving history and the global release floor.
Native Stacks commands updates:store-init, updates:store, updates:refresh and updates:recover share the library functions and compiled CLI. A separate SQLite writer transaction excludes competing processes while state transactions commit independently. ADR 0028 records why this bounded protocol file uses Bun SQLite instead of application model migrations.
Recovery replays exact committed inputs from their original base and historical time, retaining floors only. Unknown verification, integrity and storage failures remain maintenance conditions. Progress-callback rejection aborts refresh even when its raw cause is an SDK HTTP 403/404; the original error is retained as cause.
Validation: 77 focused tests, 460 assertions, zero failures; app/runtime types, Pickier, docs build, roadmap/parity, CLI compilation, eight copied standalone CLI operations, and two actual SIGKILL/competing-writer campaigns pass. The rendered docs audit covers 86 HTML pages and 6,271 local references with zero failures. Both independent review axes have no remaining actionable findings. A separate retained host file-size-limit campaign produced three actual SQLITE_IOERR_WRITE failures, including a readable retained root after a later failure; this is not ENOSPC, EDQUOT, syscall EIO or physical power-loss qualification. Exact-commit full CI is in progress for 0ee8f27522e55ddee3ae6315660dd847423e33d1. This source has not been published to main.
This is the metadata-protocol dependency of #42, which remains open with all acceptance checkboxes unchecked. Refresh does not download/authenticate actual image bytes. Signed-stage integration, key revocation/repair, complete storage-fault campaigns, installed/candidate/known-good slots and exact-image boot/session health remain unfinished. Physical deployment stays disabled; independent flight-controller and RC authority remain unchanged. Refs #9 and #42.
Persistent metadata protocol published to main
0ee8f27522e55ddee3ae6315660dd847423e33d1 is now on origin/main after a normal fast-forward push as Chris with no coauthor trailers; #46 is merged. CI 39677881028 passed all five jobs. Native tests: 1,454 passes, 39 skips, zero failures and 488,607 assertions across 180 files. All 18 reviewed source pins match the committed blobs. The full terminal log was collected once and retained: 3,012,536 bytes, SHA256 407e37fe902ae339552a02bbc82862938251d994aad723ff9ad784a522ac1d16.
This publishes protected metadata inputs/prefixes, clock/release floors and historical replay only. Actual image preparation in #47 and the guide correction in #48 still have their own live full workflows and are not yet on main. Durable candidate ownership is being implemented separately; installed/known-good slot roles, exact-image boot/session health, current-policy rollback, key revocation/repair and remaining fault/hardware campaigns stay open. All five #42 acceptance groups remain unchecked.