Add owned host slot selection, observed health confirmation and current-policy rollback to the persistent update coordinator. A candidate can become known-good only after its signed bytes match a clean trusted local neutral build, a fresh owned boot/session completes the fixed 214-input transcript, and the actual process exits cleanly. Previous known-good images and security floors survive rejected and interrupted trials.
Native Buddy commands and the standalone CLI share the coordinator: updates:trial, updates:slots, updates:rollback and exact-ID updates:abandon. Format 3 extends format 2 atomically. Recovery never promotes an unfinished trial. Rollback re-verifies current trust and observes a fresh runtime. Build tools use the qualified native Stacks bounded-process source bridge from stacksjs/stacks@3c52a79, preserving installed dependency ranges and the lockfile.
Validation:
- Pickier, application/runtime types, docs build, roadmap and parity checks pass.
- Adjacent runtime/update/diagnostic/parity suite: 152 passed, 1 Linux-only skip, 1,150 assertions.
- Pinned Bun 1.4.2 standalone binary runs outside the checkout: 17 operations and seven real process cuts pass, including competing writers, current-policy rejection, retained-image loss, exact abandonment and fresh rollback.
- Older format-2 executable rejects format 3 with both database hashes unchanged.
- Actual signed native negative fixtures reject wrong-session stop, dirty or mismatched source, changed transition/reservation state, stale/expired final clock and actual CMake output overflow. Accepted policy floors survive rejection/recovery.
- Rendered docs: 87 pages, 6,354 local links and 87 assets without missing targets/fragments. Combined local docs include this change.
- Separate root Spec and Standards passes completed. Independent final review was unavailable; no independent review claim is made.
- Full local Buddy suite completed with 1,502 passed, 25 skipped, and three failures across 187 files (489,058 assertions). The inspection timeout is tracked in #52; the 137-review 404 recurrence in #36; and purge-seal child exit 137 in #53. The failing source snapshots match published main, but source identity does not establish causality. Original failures and the complete terminal log are retained. This is not a passing local full suite.
- All new host-slot cases and the modified native runtime harness cases passed within that original full run. Linux full FIFO remains skipped locally. Exact-head CI, including the Linux regression, is required before main publication.
Refs #42, #9 and #2. This is host-only neutral-runtime evidence. Authenticated key/clock maintenance, complete write/sync/storage fault campaigns, physical board image/install/boot/power-loss and hardware anti-rollback remain open. Physical deployment is false and independent FC/RC authority is preserved. No full issue acceptance group is closed by this change.
The unchanged inspection case and whole file pass isolated with the original 30-second per-test limit. Four supplemental phase-timing runs also pass; the original #52 failure remains unexplained. Final lint/docs/roadmap/parity and rendered link checks pass after the prose correction.
Exact-head CI 39720949558 completed successfully with all five jobs, including the actual Linux FIFO regression, copied host-slot campaign, browser suites, firmware build, and purge namespace qualification. The retained original local full-suite failures remain disclosed above. The #36 setup-precondition failure now has a concrete reproduction and tests-only correction in dependent PR #55; #52 and #53 remain unresolved and are not claimed fixed. All 35 reviewed pins match committed blobs. Publication uses a normal fast-forward as Chris without coauthor trailers.