Protected preparation previously left portable files without a durable store-owned candidate identity. Add exclusive candidate reservations bound to the exact verified metadata attempt/generation and signed image description. Share the protected image/archive writer, commit prepared state only after readback, and retain candidate IDs, files and history through explicit exact-ID retirement. Metadata recovery never promotes a reservation from a stage marker.
Native updates:reserve, updates:candidates and updates:retire use the same functions as the portable CLI. Reservation atomically extends an authenticated format1 state database to format2 without replacing its identity, history or security floors. Inspection keeps format1 unchanged; older executables reject format2 before rewriting it. There is no schema downgrade/reset path. Status distinguishes incomplete, matching, mismatched and unavailable artifacts and grants no current trust or boot authority.
Validation: 106 tests, zero failures, 795 assertions across 12 adjacent files; Buddy app types, runtime types, Pickier, docs build, roadmap/parity checks and standalone compilation. The final copied binary passes 20 candidate operations, eight metadata operations and 11 preparation operations outside the checkout. Five retained actual SIGKILL/concurrent-writer cuts cover reservation, image write, marker completion, prepared commit and retirement. Actual older-binary rejection preserves both database hashes. All 86 rendered docs pages and 6,275 local links/fragments pass. Both independent review axes have zero actionable findings.
Earlier local failures are retained separately: host ENOSPC with an earlier timeout of unproven cause, followed by a SQLite test-fixture open-flag error. The fixture was corrected; production timeout/authority guards remain unchanged. These are not successful storage-fault or power-loss campaigns. Full exact-head CI is pending before normal fast-forward publication to main.
Refs #42 and #9. Depends on #47 and #48; metadata dependency #46 is already qualified on main. Installed/known-good slot roles, fresh-policy selection/rollback, exact-image boot/session health, authenticated key maintenance and complete storage/hardware qualification remain required. All #42 acceptance groups remain open. Physical deployment remains disabled and independent FC/RC authority is preserved.
Full exact-head workflow: https://github.com/stacksjs/drone/actions/runs/39687598084 (in progress).