fix: make Host updates simple and fast

Host repair could fail while adopting the published OpenCode Runtime, then repeat package and payload verification and carry durable metadata snapshots for recovery. Host preparation now verifies each acquired compound archive once, adopts signed Agent and Runtime metadata without rereading payload trees, and retries failed work by cleaning staging and preparing fresh. The desktop and Agent versions are advanced to 0.11.9 with the approved bilingual release notes. Remote Projects remain a disabled-by-default technical preview, Agent packages remain separate Linux x64/arm64 releases, and this release has no LoongArch preview. Release note: 修复 Host 更新采用失败，移除重复远端包体校验，并将中断恢复简化为清理暂存后重新准备。
2026-08-29 22:31:39 +08:00
parent a99b90cc02
commit 85e14ca626
35 changed files with 1062 additions and 1951 deletions
@@ -31,7 +31,7 @@ import {
  loadRegisteredAgentBundle,
  readManagedAgentReleaseKeyRegistry,
  RegisteredAgentBundleError,
-  verifyInstalledAgentBundle,
+  verifyPublishedAgentBundle,
  type VerifiedInstalledAgentBundle
 } from './installed-bundle-verifier'
 import { InstallationRegistry } from './installation-registry'
@@ -41,7 +41,7 @@ import {
 import {
  loadRegisteredRuntimeBundle,
  readRemoteRuntimeLock,
-  verifyRuntimeBundle,
+  verifyPublishedRuntimeBundle,
  type VerifiedRuntimeBundle
 } from './runtime-bundle-verifier'
 import { createProductionRuntimeProtocol } from './runtime-composition'
@@ -91,7 +91,7 @@ export type AgentCliDependencies = {
  runtimeReleaseKeyRegistry?: AgentReleaseKeyRegistry
  runtimeLock?: RemoteRuntimeLock
  runtimeRegistry?: RuntimeBundleRegistry
-  verifyRuntime?: typeof verifyRuntimeBundle
+  verifyRuntime?: typeof verifyPublishedRuntimeBundle
  runtimeVerificationEnvironment?: 'production' | 'test'
  currentArchitecture?: () => AgentArchitecture
  runModelBridgeHelper?: typeof runOpenCodeModelBridgeHelper
@@ -299,7 +299,7 @@ async function runRuntime(
  const verified =
    registered === undefined || forceVerification
    ? await (
-        dependencies.verifyRuntime ?? verifyRuntimeBundle
+        dependencies.verifyRuntime ?? verifyPublishedRuntimeBundle
      )(paths.bundleDirectory, verificationOptions)
    : await loadRegisteredRuntimeBundle(
        registered.bundleDirectory,
@@ -524,10 +524,11 @@ async function runLifecycle(
          paths,
          dependencies
        )
-      const alreadyCurrent =
+      const currentInstallationMatches =
        registry.snapshot().current?.installationId ===
        installationId
-      if (!alreadyCurrent) {
+      const alreadyCurrent = registry.isCurrent(verified)
+      if (!alreadyCurrent && !currentInstallationMatches) {
        registry.stageCandidate(verified)
      }
      prepareManagedSocketDirectory(paths)
@@ -539,7 +540,11 @@ async function runLifecycle(
        verified
      ).bootstrap()
      if (!alreadyCurrent) {
-        registry.promoteCandidate(installationId)
+        if (currentInstallationMatches) {
+          registry.refreshCurrent(verified)
+        } else {
+          registry.promoteCandidate(installationId)
+        }
      }
      io.output.write(`${JSON.stringify(status)}\n`)
      break
@@ -757,7 +762,7 @@ async function verifyManagedInstallation(
      storagePath: resolve(agentRoot, 'registry.json')
    })
  const verified = await (
-    dependencies.verifyInstallation ?? verifyInstalledAgentBundle
+    dependencies.verifyInstallation ?? verifyPublishedAgentBundle
  )(dirname(paths.executablePath), {
    installationId,
    architecture,
@@ -76,6 +76,33 @@ describe('Agent installation registry', () => {
    ).toThrow('authorized registry role')
  })

+  it('replaces same-installation legacy metadata after verification', () => {
+    const root = privateTemporaryDirectory()
+    const storagePath = resolve(root, 'registry.json')
+    writeFileSync(
+      storagePath,
+      `${JSON.stringify({
+        formatVersion: 1,
+        current: {
+          installationId: 'install-a',
+          agentVersion: '0.11.1',
+          manifestSha256: 'a'.repeat(64),
+          arch: 'x64'
+        }
+      }, null, 2)}\n`,
+      { mode: 0o600 }
+    )
+    const registry = new InstallationRegistry({ storagePath })
+    const current = verified('install-a', '0.11.1', 'a')
+
+    expect(registry.isCurrent(current)).toBe(false)
+    registry.refreshCurrent(current)
+    expect(registry.snapshot().current).toMatchObject({
+      installationId: 'install-a',
+      protocol: { major: 1, minor: 0 }
+    })
+  })
+
  it('replaces a stale candidate with the requested signed identity', () => {
    const { registry } = createRegistry()
    registry.stageCandidate(verified('install-a', '0.11.0', 'a'))
@@ -40,6 +40,14 @@ export class InstallationRegistry {
    return structuredClone(this.#state)
  }

+  isCurrent(verified: VerifiedInstalledAgentBundle): boolean {
+    const current = this.#state.current
+    return (
+      current !== undefined &&
+      entryEquals(current, entryFromVerified(verified))
+    )
+  }
+
  stageCandidate(
    verified: VerifiedInstalledAgentBundle
  ): InstallationRegistryEntry {
@@ -100,6 +108,25 @@ export class InstallationRegistry {
    return this.snapshot()
  }

+  refreshCurrent(
+    verified: VerifiedInstalledAgentBundle
+  ): InstallationRegistryState {
+    const entry = entryFromVerified(verified)
+    if (
+      this.#state.current?.installationId !==
+      entry.installationId
+    ) {
+      throw new Error(
+        'Verified Agent installation is not the current identity'
+      )
+    }
+    this.#commit({
+      formatVersion: 1,
+      current: entry
+    })
+    return this.snapshot()
+  }
+
  assertVerifiedRole(
    verified: VerifiedInstalledAgentBundle,
    roles: readonly ('current' | 'candidate')[]
@@ -234,7 +261,9 @@ function entryEquals(
    left.installationId === right.installationId &&
    left.agentVersion === right.agentVersion &&
    left.manifestSha256 === right.manifestSha256 &&
-    left.arch === right.arch
+    left.arch === right.arch &&
+    JSON.stringify(left.protocol) ===
+      JSON.stringify(right.protocol)
  )
 }

@@ -24,6 +24,7 @@ import {
  canonicalInstalledAgentManifestBytes,
  installedAgentManifestSignaturePayload,
  loadRegisteredAgentBundle,
+  verifyPublishedAgentBundle,
  verifyInstalledAgentBundle
 } from './installed-bundle-verifier'

@@ -88,7 +89,7 @@ describe('installed Agent bundle verifier', () => {
      'tampered'
    )
    await expect(verifyBundle()).rejects.toThrow(
-      /size mismatch|hash mismatch/u
+      /entrypoint metadata changed|size mismatch|hash mismatch/u
    )

    resetInstallation()
@@ -134,6 +135,26 @@ describe('installed Agent bundle verifier', () => {

  })

+  it('adopts signed published metadata without rehashing unrelated payload', async () => {
+    writeBundle()
+    writeFileSync(
+      join(installationDirectory, 'licenses', 'GoodBuddy-0BSD.txt'),
+      'changed after extraction'
+    )
+    await expect(verifyPublishedBundle()).resolves.toMatchObject({
+      installationId: 'install-10',
+      manifest: { agentVersion: '0.11.0' }
+    })
+
+    writeFileSync(
+      join(installationDirectory, 'lib', 'agent.cjs'),
+      'changed entrypoint'
+    )
+    await expect(verifyPublishedBundle()).rejects.toThrow(
+      'entrypoint metadata changed'
+    )
+  })
+
  it('loads Host-managed registry evidence without repeating signature or payload verification', async () => {
    writeBundle()
    const manifestBytes = readFileSync(
@@ -269,6 +290,16 @@ function verifyBundle() {
  })
 }

+function verifyPublishedBundle() {
+  return verifyPublishedAgentBundle(installationDirectory, {
+    installationId: 'install-10',
+    architecture: 'x64',
+    releaseKeyRegistry,
+    verificationEnvironment: 'test',
+    enforceFilesystemMode: process.platform !== 'win32'
+  })
+}
+
 function elf(architecture: 'x64' | 'arm64'): Buffer {
  const header = Buffer.alloc(64)
  header.set([0x7f, 0x45, 0x4c, 0x46])
@@ -110,6 +110,66 @@ export async function readManagedAgentReleaseKeyRegistry(
 export async function verifyInstalledAgentBundle(
  installationDirectoryInput: string,
  options: VerifyInstalledAgentBundleOptions
+): Promise<VerifiedInstalledAgentBundle> {
+  const verified = await verifyPublishedAgentBundle(
+    installationDirectoryInput,
+    options
+  )
+  const {
+    installationDirectory,
+    manifest
+  } = verified
+  const declaredPaths = new Set(
+    manifest.files.map((file) => file.path)
+  )
+  for (const file of manifest.files) {
+    const filePath = join(
+      installationDirectory,
+      ...file.path.split('/')
+    )
+    const stat = await lstat(filePath)
+    assertOwnedRegularFile(stat, file.path, options.uid)
+    if (stat.size !== file.size) {
+      throw new Error(`Agent payload size mismatch: ${file.path}`)
+    }
+    if ((await sha256File(filePath)) !== file.sha256) {
+      throw new Error(`Agent payload hash mismatch: ${file.path}`)
+    }
+    if (
+      shouldEnforceMode(options) &&
+      modeString(stat.mode) !== file.mode
+    ) {
+      throw new Error(`Agent payload mode mismatch: ${file.path}`)
+    }
+  }
+
+  const actualPaths = new Set(
+    await listInstallationFiles(installationDirectory, options)
+  )
+  const expectedPaths = new Set([
+    ...declaredPaths,
+    MANIFEST_FILE_NAME,
+    SIGNATURE_FILE_NAME
+  ])
+  if (
+    actualPaths.size !== expectedPaths.size ||
+    [...actualPaths].some((path) => !expectedPaths.has(path))
+  ) {
+    throw new Error(
+      'Agent installation contains undeclared or missing files'
+    )
+  }
+  return verified
+}
+
+/**
+ * Authenticates a package-installer-published Agent from signed metadata and
+ * bounded entrypoint metadata. The installer already hashed every payload
+ * file while extracting it.
+ */
+export async function verifyPublishedAgentBundle(
+  installationDirectoryInput: string,
+  options: VerifyInstalledAgentBundleOptions
 ): Promise<VerifiedInstalledAgentBundle> {
  const installationId = validateInstallationId(options.installationId)
  const installationDirectory = resolve(installationDirectoryInput)
@@ -162,47 +222,11 @@ export async function verifyInstalledAgentBundle(
    )
  }

-  const declaredPaths = new Set(
-    manifest.files.map((file) => file.path)
+  const executablePath = await assertAgentEntrypoints(
+    installationDirectory,
+    manifest,
+    options
  )
-  for (const file of manifest.files) {
-    const filePath = join(
-      installationDirectory,
-      ...file.path.split('/')
-    )
-    const stat = await lstat(filePath)
-    assertOwnedRegularFile(stat, file.path, options.uid)
-    if (stat.size !== file.size) {
-      throw new Error(`Agent payload size mismatch: ${file.path}`)
-    }
-    if ((await sha256File(filePath)) !== file.sha256) {
-      throw new Error(`Agent payload hash mismatch: ${file.path}`)
-    }
-    if (
-      shouldEnforceMode(options) &&
-      modeString(stat.mode) !== file.mode
-    ) {
-      throw new Error(`Agent payload mode mismatch: ${file.path}`)
-    }
-  }
-
-  const actualPaths = new Set(
-    await listInstallationFiles(installationDirectory, options)
-  )
-  const expectedPaths = new Set([
-    ...declaredPaths,
-    MANIFEST_FILE_NAME,
-    SIGNATURE_FILE_NAME
-  ])
-  if (
-    actualPaths.size !== expectedPaths.size ||
-    [...actualPaths].some((path) => !expectedPaths.has(path))
-  ) {
-    throw new Error(
-      'Agent installation contains undeclared or missing files'
-    )
-  }
-
  await assertElfArchitecture(
    join(installationDirectory, manifest.entrypoint.runtimePath),
    manifest.arch,
@@ -212,10 +236,7 @@ export async function verifyInstalledAgentBundle(
  return {
    installationId,
    installationDirectory,
-    executablePath: join(
-      installationDirectory,
-      manifest.entrypoint.path
-    ),
+    executablePath,
    manifest,
    manifestSha256,
    binaryDigest: `sha256:${manifestSha256}`
@@ -326,19 +347,9 @@ async function loadRegisteredAgentBundleUnchecked(
    )
  }

-  const executablePath = join(
+  const executablePath = await assertAgentEntrypoints(
    installationDirectory,
-    manifest.entrypoint.path
-  )
-  await assertRegisteredEntrypoint(executablePath, '0755', options)
-  await assertRegisteredEntrypoint(
-    join(installationDirectory, manifest.entrypoint.runtimePath),
-    '0755',
-    options
-  )
-  await assertRegisteredEntrypoint(
-    join(installationDirectory, manifest.entrypoint.scriptPath),
-    '0644',
+    manifest,
    options
  )
  return {
@@ -500,24 +511,45 @@ function importPublicKey(key: AgentReleaseKey) {
  return publicKey
 }

-async function assertRegisteredEntrypoint(
-  filePath: string,
-  expectedMode: string,
+async function assertAgentEntrypoints(
+  installationDirectory: string,
+  manifest: AgentBundleManifest,
  options: Pick<
-    LoadRegisteredAgentBundleOptions,
+    VerifyInstalledAgentBundleOptions,
    'uid' | 'filesystemPlatform' | 'enforceFilesystemMode'
  >
-): Promise<void> {
-  const stat = await lstat(filePath)
-  assertOwnedRegularFile(stat, filePath, options.uid)
-  if (
-    shouldEnforceMode(options) &&
-    modeString(stat.mode) !== expectedMode
-  ) {
-    throw new Error(
-      `Agent payload mode mismatch: ${basename(filePath)}`
+): Promise<string> {
+  for (const path of [
+    manifest.entrypoint.path,
+    manifest.entrypoint.runtimePath,
+    manifest.entrypoint.scriptPath
+  ]) {
+    const record = manifest.files.find((file) => file.path === path)
+    if (record === undefined) {
+      throw new Error(`Agent entrypoint is not declared: ${path}`)
+    }
+    const filePath = join(
+      installationDirectory,
+      ...path.split('/')
    )
+    const stat = await lstat(filePath)
+    assertOwnedRegularFile(stat, filePath, options.uid)
+    if (
+      stat.size !== record.size ||
+      (
+        shouldEnforceMode(options) &&
+        modeString(stat.mode) !== record.mode
+      )
+    ) {
+      throw new Error(
+        `Agent entrypoint metadata changed: ${basename(filePath)}`
+      )
+    }
  }
+  return join(
+    installationDirectory,
+    manifest.entrypoint.path
+  )
 }

 async function readMetadataFile(
@@ -283,8 +283,8 @@ async function loadVerifiedRuntimeCapabilities(
          entry.runtimeId,
          entry.bundleDigest
        )
-      const verified = options.loadRegistered === undefined
-        ? await loadRegisteredRuntimeBundle(
+      await (options.loadRegistered === undefined
+        ? loadRegisteredRuntimeBundle(
            bundleDirectory,
            {
              registered: entry,
@@ -315,21 +315,10 @@ async function loadVerifiedRuntimeCapabilities(
                : { uid: options.uid })
            }
          )
-        : await options.loadRegistered(
+        : options.loadRegistered(
            entry,
            bundleDirectory
-          )
-      if (
-        verified.manifest.runtimeVersion !== entry.runtimeVersion ||
-        verified.manifestDigest !== entry.manifestDigest ||
-        verified.manifest.bundleDigest !== entry.bundleDigest ||
-        verified.manifest.acpCapabilitiesDigest !==
-          entry.acpCapabilitiesDigest
-      ) {
-        throw new Error(
-          'Runtime bundle no longer matches its registry identity'
-        )
-      }
+          ))
      capabilities.push({
        runtimeId: entry.runtimeId,
        version: entry.runtimeVersion,
@@ -8,7 +8,10 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
  type RemoteRuntimeBundleManifest
 } from '../shared/remote-runtime-launch-contracts'
-import { verifyRuntimeBundle } from './runtime-bundle-verifier'
+import {
+  verifyPublishedRuntimeBundle,
+  verifyRuntimeBundle
+} from './runtime-bundle-verifier'
 import {
  RuntimeBundleRegistry,
  createVerifiedRuntimeCapabilitySource
@@ -216,6 +219,45 @@ describe('Remote Runtime bundle verifier', () => {
      expect.any(Error)
    )
  })
+
+  it('adopts signed published metadata without rehashing unrelated payload', async () => {
+    const fixture = await createBundle()
+    const options = {
+      architecture: 'x64' as const,
+      releaseKeyRegistry: fixture.registry,
+      runtimeLock: lock,
+      verificationEnvironment: 'test' as const,
+      filesystemPlatform: 'win32' as const
+    }
+    writeFileSync(
+      join(fixture.bundleDirectory, 'licenses', 'opencode.txt'),
+      'changed after extraction'
+    )
+    await expect(
+      verifyPublishedRuntimeBundle(
+        fixture.bundleDirectory,
+        options
+      )
+    ).resolves.toMatchObject({
+      manifest: { runtimeVersion: '1.18.9' }
+    })
+
+    writeFileSync(
+      join(fixture.bundleDirectory, 'bin', 'opencode'),
+      Buffer.concat([
+        readFileSync(
+          join(fixture.bundleDirectory, 'bin', 'opencode')
+        ),
+        Buffer.from('changed')
+      ])
+    )
+    await expect(
+      verifyPublishedRuntimeBundle(
+        fixture.bundleDirectory,
+        options
+      )
+    ).rejects.toThrow('entrypoint metadata changed')
+  })
 })

 async function createBundle(
@@ -3,6 +3,7 @@ export {
  loadRegisteredRuntimeBundle,
  readRemoteRuntimeLock,
  runtimeManifestSignaturePayload,
+  verifyPublishedRuntimeBundle,
  verifyRuntimeBundle,
  verifyRuntimeManifestSignature
 } from '../shared/node/runtime-bundle-verifier'
@@ -240,20 +240,10 @@ export async function createProductionRuntimeProtocol(
          options.architecture
        ),
      loadRegisteredRuntimeBundle: async (resolved) => {
-        const verified = await loadRegistered(
+        return await loadRegistered(
          resolved.entry,
          resolved.bundleDirectory
        )
-        if (
-          verified.manifestDigest !== resolved.entry.manifestDigest ||
-          verified.manifest.bundleDigest !==
-            resolved.entry.bundleDigest
-        ) {
-          throw new Error(
-            'Runtime bundle no longer matches its registered identity'
-          )
-        }
-        return verified
      },
      resolveWorkspace: async (preparation, context) =>
        resolveCurrentWorkspace(
@@ -25,7 +25,6 @@ import { HostActivationCoordinator } from './host-activation-coordinator'
 import { isMissingPathError } from './path-errors'
 import { remoteHostTargetIdentityKey } from './remote-host-target-identity'

-const PRIVATE_FILE_MODE = 0o600
 const MAXIMUM_METADATA_BYTES = 1024 * 1024
 const AGENT_REGISTRY_PATH = '.goodbuddy/agent/registry.json'
 const MAXIMUM_DIAGNOSTIC_CHARACTERS = 800
@@ -192,19 +191,6 @@ export class AgentInstallationManager {
        },
        signal
      )
-      const metadata = await sftp.lstat(
-        AGENT_REGISTRY_PATH,
-        signal
-      )
-      if (
-        metadata.type !== 'file' ||
-        metadata.uid !== probe.uid ||
-        metadata.mode !== PRIVATE_FILE_MODE
-      ) {
-        throw new Error(
-          'Installed Agent registry metadata is invalid'
-        )
-      }
      const registry = parseInstallationRegistryState(
        parseJsonBytes(
          await sftp.readFile(AGENT_REGISTRY_PATH, signal),
@@ -142,6 +142,8 @@ type InstallerOptions = {
  operationRoot: string
  archive: string
  expectedSha256: string
+  /** The acquisition path verified the archive before installer execution. */
+  archiveSha256Verified?: boolean
  homeDirectory?: string
  emit?: (event: PackageInstallerEvent) => void
 }
@@ -1361,6 +1363,7 @@ function sameSnapshot(
 function verifyArchive(
  archivePath: string,
  expectedSha256: string,
+  archiveSha256Verified: boolean,
  emit: (phase: string) => void
 ): VerifiedPackage {
  const handle = openSync(
@@ -1376,11 +1379,14 @@ function verifyArchive(
    ) {
      throw new Error('Agent package archive is not a bounded regular file')
    }
-    emit('hashing-archive')
-    const archiveSha256 = hashArchive(handle, snapshot.size)
-    if (archiveSha256 !== expectedSha256) {
-      throw new Error('Agent package archive SHA-256 does not match the authenticated catalog')
+    if (!archiveSha256Verified) {
+      emit('hashing-archive')
+      const archiveSha256 = hashArchive(handle, snapshot.size)
+      if (archiveSha256 !== expectedSha256) {
+        throw new Error('Agent package archive SHA-256 does not match the authenticated catalog')
+      }
    }
+    const archiveSha256 = expectedSha256
    emit('verifying-zip')
    const entries = parseZip(handle, snapshot.size)
    const descriptorBytes = readEntry(handle, entries, PACKAGE_DESCRIPTOR)
@@ -1637,28 +1643,7 @@ function persistPreparedState(
  if (bytes.length > MAXIMUM_METADATA_BYTES) {
    throw new Error('Prepared package state exceeds its limit')
  }
-  const handle = openSync(
-    temporary,
-    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
-    0o600
-  )
-  try {
-    let offset = 0
-    while (offset < bytes.length) {
-      offset += writeFileChunk(handle, bytes, offset)
-    }
-    fsyncSync(handle)
-  } finally {
-    closeSync(handle)
-  }
-  try {
-    chmodSync(temporary, 0o600)
-    renameSync(temporary, destination)
-  } finally {
-    if (existsSync(temporary)) {
-      unlinkSync(temporary)
-    }
-  }
+  writeBufferAtomically(destination, temporary, bytes)
 }

 function writePreparedFile(
@@ -1677,6 +1662,15 @@ function writePreparedFile(
    directory,
    `.${name}-${process.pid}-${Date.now().toString(36)}.tmp`
  )
+  writeBufferAtomically(destination, temporary, bytes)
+}
+
+function writeBufferAtomically(
+  destination: string,
+  temporary: string,
+  bytes: Buffer,
+  replaceExistingOnWindows = false
+): void {
  const handle = openSync(
    temporary,
    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
@@ -1693,6 +1687,13 @@ function writePreparedFile(
  }
  try {
    chmodSync(temporary, 0o600)
+    if (
+      replaceExistingOnWindows &&
+      process.platform === 'win32' &&
+      existsSync(destination)
+    ) {
+      unlinkSync(destination)
+    }
    renameSync(temporary, destination)
  } finally {
    if (existsSync(temporary)) {
@@ -1808,6 +1809,7 @@ export function preparePackage(options: InstallerOptions): PackageInstallerResul
  const verified = verifyArchive(
    inputs.archive,
    inputs.expectedSha256,
+    options.archiveSha256Verified === true,
    progress
  )
  try {
@@ -1940,31 +1942,12 @@ function writePrivateFileAtomic(
    dirname(destination),
    `.${basename(destination)}-${process.pid}-${Date.now().toString(36)}.tmp`
  )
-  const handle = openSync(
+  writeBufferAtomically(
+    destination,
    temporary,
-    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
-    0o600
+    contents,
+    true
  )
-  try {
-    let offset = 0
-    while (offset < contents.length) {
-      offset += writeFileChunk(handle, contents, offset)
-    }
-    fsyncSync(handle)
-  } finally {
-    closeSync(handle)
-  }
-  try {
-    chmodSync(temporary, 0o600)
-    if (process.platform === 'win32' && existsSync(destination)) {
-      unlinkSync(destination)
-    }
-    renameSync(temporary, destination)
-  } finally {
-    if (existsSync(temporary)) {
-      unlinkSync(temporary)
-    }
-  }
 }

 function restoreLocalMetadata(
@@ -2571,14 +2554,18 @@ function parseCli(argv: readonly string[]): {
  const command = argv[0]
  if (command !== 'prepare' && command !== 'commit') {
    throw new Error(
-      'Usage: remote-package-installer.mjs <prepare|commit> --operation-root <absolute-path> --archive <absolute-path> --expected-sha256 <hex>'
+      'Usage: remote-package-installer.mjs <prepare|commit> --operation-root <absolute-path> --archive <absolute-path> --expected-sha256 <hex> [--archive-sha256-verified true]'
    )
  }
  const values: Record<string, string> = {}
-  const allowed = new Set([
+  const required = [
    '--operation-root',
    '--archive',
    '--expected-sha256'
+  ] as const
+  const allowed = new Set([
+    ...required,
+    '--archive-sha256-verified'
  ])
  for (let index = 1; index < argv.length; index += 2) {
    const flag = argv[index]
@@ -2594,17 +2581,25 @@ function parseCli(argv: readonly string[]): {
    }
    values[flag] = value
  }
-  for (const flag of allowed) {
+  for (const flag of required) {
    if (values[flag] === undefined) {
      throw new Error(`Missing required package installer argument: ${flag}`)
    }
  }
+  if (
+    values['--archive-sha256-verified'] !== undefined &&
+    values['--archive-sha256-verified'] !== 'true'
+  ) {
+    throw new Error('Invalid package installer argument')
+  }
  return {
    command,
    options: {
      operationRoot: values['--operation-root']!,
      archive: values['--archive']!,
-      expectedSha256: values['--expected-sha256']!
+      expectedSha256: values['--expected-sha256']!,
+      archiveSha256Verified:
+        values['--archive-sha256-verified'] === 'true'
    }
  }
 }
@@ -1,207 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import type {
-  SftpEntryMetadata,
-  StagedSftp
-} from '../ssh/bounded-sftp'
-import {
-  REMOTE_ENVIRONMENT_METADATA_PATHS,
-  restoreRemoteEnvironmentMetadata,
-  snapshotRemoteEnvironmentMetadata,
-  type RemoteEnvironmentMetadataSnapshot
-} from './remote-environment-metadata'
-
-const UID = 1000
-
-function missingPath(): Error & { code: string } {
-  return Object.assign(new Error('missing'), { code: 'ENOENT' })
-}
-
-function fileMetadata(
-  contents: Buffer,
-  overrides: Partial<SftpEntryMetadata> = {}
-): SftpEntryMetadata {
-  return {
-    type: 'file',
-    size: contents.byteLength,
-    mode: 0o600,
-    uid: UID,
-    gid: UID,
-    atime: 0,
-    mtime: 0,
-    ...overrides
-  }
-}
-
-function createSftp(
-  initial: ReadonlyMap<string, Buffer>,
-  metadataOverrides: ReadonlyMap<string, Partial<SftpEntryMetadata>> =
-    new Map()
-) {
-  const files = new Map(
-    [...initial].map(([path, contents]) => [path, Buffer.from(contents)])
-  )
-  const temporary = new Map<string, Buffer>()
-  const sftp: StagedSftp = {
-    stagingDirectory: '/home/goodbuddy',
-    mkdir: vi.fn(),
-    uploadFile: vi.fn(),
-    writeFile: vi.fn(async (path, contents) => {
-      temporary.set(path, Buffer.from(contents))
-    }),
-    readFile: vi.fn(async (path) => {
-      const contents = files.get(path) ?? temporary.get(path)
-      if (!contents) throw missingPath()
-      return Buffer.from(contents)
-    }),
-    lstat: vi.fn(async (path) => {
-      const contents = files.get(path) ?? temporary.get(path)
-      if (!contents) throw missingPath()
-      return fileMetadata(
-        contents,
-        metadataOverrides.get(path)
-      )
-    }),
-    stat: vi.fn(),
-    chmod: vi.fn(),
-    setExecutable: vi.fn(),
-    rename: vi.fn(),
-    replaceFile: vi.fn(async (source, destination) => {
-      const contents = temporary.get(source)
-      if (!contents) throw missingPath()
-      files.set(destination, Buffer.from(contents))
-      temporary.delete(source)
-    }),
-    unlink: vi.fn(async (path) => {
-      if (!files.delete(path) && !temporary.delete(path)) {
-        throw missingPath()
-      }
-    }),
-    rmdir: vi.fn(),
-    close: vi.fn()
-  }
-  return { sftp, files, temporary }
-}
-
-describe('remote environment metadata', () => {
-  it('snapshots original bytes and restores them exactly', async () => {
-    const originals = new Map(
-      REMOTE_ENVIRONMENT_METADATA_PATHS.map((path, index) => [
-        path,
-        Buffer.from([0, index, 255, 10])
-      ])
-    )
-    const value = createSftp(originals)
-    const snapshots = await snapshotRemoteEnvironmentMetadata(
-      value.sftp,
-      UID,
-      new AbortController().signal
-    )
-    for (const path of REMOTE_ENVIRONMENT_METADATA_PATHS) {
-      value.files.set(path, Buffer.from('changed'))
-    }
-
-    await restoreRemoteEnvironmentMetadata(value.sftp, snapshots)
-
-    expect(
-      REMOTE_ENVIRONMENT_METADATA_PATHS.map((path) =>
-        value.files.get(path)
-      )
-    ).toEqual(
-      REMOTE_ENVIRONMENT_METADATA_PATHS.map((path) =>
-        originals.get(path)
-      )
-    )
-    expect(value.sftp.chmod).toHaveBeenCalledTimes(5)
-    expect(value.sftp.replaceFile).toHaveBeenCalledTimes(5)
-  })
-
-  it('records missing metadata and removes files created after the snapshot', async () => {
-    const value = createSftp(new Map())
-    const snapshots = await snapshotRemoteEnvironmentMetadata(
-      value.sftp,
-      UID,
-      new AbortController().signal
-    )
-    for (const path of REMOTE_ENVIRONMENT_METADATA_PATHS) {
-      value.files.set(path, Buffer.from('new'))
-    }
-
-    await restoreRemoteEnvironmentMetadata(value.sftp, snapshots)
-
-    expect(value.files.size).toBe(0)
-    expect(value.sftp.unlink).toHaveBeenCalledTimes(5)
-  })
-
-  it('distinguishes an empty original file from a missing file', async () => {
-    const path = REMOTE_ENVIRONMENT_METADATA_PATHS[0]
-    const value = createSftp(
-      new Map([[path, Buffer.alloc(0)]])
-    )
-    const snapshots = await snapshotRemoteEnvironmentMetadata(
-      value.sftp,
-      UID,
-      new AbortController().signal
-    )
-    value.files.set(path, Buffer.from('changed'))
-
-    await restoreRemoteEnvironmentMetadata(value.sftp, snapshots)
-
-    expect(value.files.get(path)).toEqual(Buffer.alloc(0))
-  })
-
-  it.each([
-    ['permissions', { mode: 0o644 }],
-    ['owner', { uid: UID + 1 }],
-    ['symbolic link', { type: 'symbolic-link' as const }]
-  ])('rejects metadata with invalid %s', async (_label, override) => {
-    const path = REMOTE_ENVIRONMENT_METADATA_PATHS[0]
-    const contents = Buffer.from('metadata')
-    const value = createSftp(
-      new Map([[path, contents]]),
-      new Map([[path, override]])
-    )
-
-    await expect(snapshotRemoteEnvironmentMetadata(
-      value.sftp,
-      UID,
-      new AbortController().signal
-    )).rejects.toThrow('类型、所有者或权限无效')
-    expect(value.sftp.readFile).not.toHaveBeenCalled()
-  })
-
-  it('continues restoring remaining files and aggregates every error', async () => {
-    const first = REMOTE_ENVIRONMENT_METADATA_PATHS[0]
-    const second = REMOTE_ENVIRONMENT_METADATA_PATHS[1]
-    const third = REMOTE_ENVIRONMENT_METADATA_PATHS[2]
-    const value = createSftp(new Map([
-      [first, Buffer.from('changed-1')],
-      [second, Buffer.from('changed-2')],
-      [third, Buffer.from('created')]
-    ]))
-    const firstError = new Error('first replace failed')
-    const secondError = new Error('second replace failed')
-    vi.mocked(value.sftp.replaceFile).mockImplementation(
-      async (_source, destination) => {
-        throw destination === first ? firstError : secondError
-      }
-    )
-    const snapshots: readonly RemoteEnvironmentMetadataSnapshot[] = [
-      { path: first, contents: Buffer.from('original-1'), uid: UID },
-      { path: second, contents: Buffer.from('original-2'), uid: UID },
-      { path: third, uid: UID }
-    ]
-
-    const caught = await restoreRemoteEnvironmentMetadata(
-      value.sftp,
-      snapshots
-    ).catch((error: unknown) => error)
-
-    expect(caught).toBeInstanceOf(AggregateError)
-    expect((caught as AggregateError).errors).toEqual([
-      firstError,
-      secondError
-    ])
-    expect(value.sftp.replaceFile).toHaveBeenCalledTimes(2)
-    expect(value.files.has(third)).toBe(false)
-  })
-})
@@ -1,142 +0,0 @@
-import { randomUUID } from 'node:crypto'
-import type { StagedSftp } from '../ssh/bounded-sftp'
-import { isMissingPathError } from './path-errors'
-
-const PRIVATE_FILE_MODE = 0o600
-
-export const REMOTE_ENVIRONMENT_METADATA_PATHS = [
-  '.goodbuddy/agent/release-keys.json',
-  '.goodbuddy/agent/registry.json',
-  '.goodbuddy/runtimes/release-keys.json',
-  '.goodbuddy/runtimes/remote-runtime-lock.json',
-  '.goodbuddy/runtimes/registry.json'
-] as const
-
-export type RemoteEnvironmentMetadataSnapshot = {
-  path: (typeof REMOTE_ENVIRONMENT_METADATA_PATHS)[number]
-  contents?: Buffer
-  uid: number
-}
-
-export async function snapshotRemoteEnvironmentMetadata(
-  sftp: StagedSftp,
-  uid: number,
-  signal: AbortSignal
-): Promise<readonly RemoteEnvironmentMetadataSnapshot[]> {
-  const snapshots: RemoteEnvironmentMetadataSnapshot[] = []
-  for (const path of REMOTE_ENVIRONMENT_METADATA_PATHS) {
-    signal.throwIfAborted()
-    const metadata = await metadataIfPresent(sftp, path, signal)
-    if (!metadata) {
-      snapshots.push({ path, uid })
-      continue
-    }
-    assertPrivateFile(metadata, path, uid)
-    snapshots.push({
-      path,
-      contents: await sftp.readFile(path, signal),
-      uid
-    })
-  }
-  return snapshots
-}
-
-export async function restoreRemoteEnvironmentMetadata(
-  sftp: StagedSftp,
-  snapshots: readonly RemoteEnvironmentMetadataSnapshot[]
-): Promise<void> {
-  const errors: unknown[] = []
-  for (const snapshot of snapshots) {
-    try {
-      await restoreRemoteEnvironmentMetadataFile(sftp, snapshot)
-    } catch (error) {
-      errors.push(error)
-    }
-  }
-  if (errors.length > 0) {
-    throw new AggregateError(
-      errors,
-      '远程运行环境元数据回滚不完整'
-    )
-  }
-}
-
-async function restoreRemoteEnvironmentMetadataFile(
-  sftp: StagedSftp,
-  snapshot: RemoteEnvironmentMetadataSnapshot
-): Promise<void> {
-  const existing = await metadataIfPresent(sftp, snapshot.path)
-  if (snapshot.contents === undefined) {
-    if (existing) {
-      assertPrivateFile(existing, snapshot.path, snapshot.uid)
-      await sftp.unlink(snapshot.path)
-    }
-    return
-  }
-
-  if (existing) {
-    assertPrivateFile(existing, snapshot.path, snapshot.uid)
-    if (
-      existing.size === snapshot.contents.byteLength &&
-      (await sftp.readFile(snapshot.path)).equals(snapshot.contents)
-    ) {
-      return
-    }
-  }
-
-  const temporary =
-    `.goodbuddy/.environment-metadata-rollback-${randomUUID()}.tmp`
-  try {
-    await sftp.writeFile(temporary, snapshot.contents)
-    await sftp.chmod(temporary, PRIVATE_FILE_MODE)
-    await sftp.replaceFile(temporary, snapshot.path)
-    const restored = await sftp.lstat(snapshot.path)
-    assertPrivateFile(restored, snapshot.path, snapshot.uid)
-    if (
-      restored.size !== snapshot.contents.byteLength ||
-      !(await sftp.readFile(snapshot.path)).equals(snapshot.contents)
-    ) {
-      throw new Error(
-        `远程运行环境元数据 ${snapshot.path} 回滚校验失败`
-      )
-    }
-  } catch (error) {
-    await sftp.unlink(temporary).catch((cleanupError: unknown) => {
-      if (!isMissingPathError(cleanupError)) {
-        throw cleanupError
-      }
-    })
-    throw error
-  }
-}
-
-async function metadataIfPresent(
-  sftp: StagedSftp,
-  path: string,
-  signal?: AbortSignal
-) {
-  try {
-    return await sftp.lstat(path, signal)
-  } catch (error) {
-    if (isMissingPathError(error)) {
-      return undefined
-    }
-    throw error
-  }
-}
-
-function assertPrivateFile(
-  metadata: Awaited<ReturnType<StagedSftp['lstat']>>,
-  path: string,
-  uid: number
-): void {
-  if (
-    metadata.type !== 'file' ||
-    metadata.uid !== uid ||
-    metadata.mode !== PRIVATE_FILE_MODE
-  ) {
-    throw new Error(
-      `远程运行环境元数据 ${path} 的类型、所有者或权限无效`
-    )
-  }
-}
@@ -12,10 +12,7 @@ const operation: PendingRemoteEnvironmentOperation = {
  version: 1,
  hostId: 'host-1',
  targetIdentity: 'a'.repeat(64),
-  operationId: '00000000-0000-4000-8000-000000000777',
-  size: 123,
-  sha256: 'b'.repeat(64),
-  urls: []
+  operationId: '00000000-0000-4000-8000-000000000777'
 }

 afterEach(async () => {
@@ -42,39 +39,6 @@ describe('RemoteEnvironmentOperationStore', () => {
    await expect(store.load(operation.hostId)).resolves.toBeUndefined()
  })

-  it('persists bounded metadata snapshots for post-commit recovery', async () => {
-    const root = await mkdtemp(
-      join(tmpdir(), 'goodbuddy-environment-operation-')
-    )
-    temporaryDirectories.push(root)
-    const store = new RemoteEnvironmentOperationStore(root)
-    const recovered: PendingRemoteEnvironmentOperation = {
-      ...operation,
-      version: 2,
-      metadataSnapshots: [
-        '.goodbuddy/agent/release-keys.json',
-        '.goodbuddy/agent/registry.json',
-        '.goodbuddy/runtimes/release-keys.json',
-        '.goodbuddy/runtimes/remote-runtime-lock.json',
-        '.goodbuddy/runtimes/registry.json'
-      ].map((path, index) => ({
-        path: path as never,
-        uid: 1000,
-        ...(index === 1
-          ? {}
-          : {
-              contentsBase64:
-                Buffer.from(`metadata-${index}`).toString('base64')
-            })
-      }))
-    }
-
-    await store.save(recovered)
-    await expect(store.load(operation.hostId)).resolves.toEqual(
-      recovered
-    )
-  })
-
  it('rejects a mismatched or oversized recovery record', async () => {
    const root = await mkdtemp(
      join(tmpdir(), 'goodbuddy-environment-operation-')
@@ -91,7 +55,7 @@ describe('RemoteEnvironmentOperationStore', () => {
    const [record] = await readdir(files)
    await writeFile(
      join(files, record!),
-      Buffer.alloc(8 * 1024 * 1024 + 1)
+      Buffer.alloc(4 * 1024 + 1)
    )

    await expect(store.load(operation.hostId)).rejects.toThrow(
@@ -6,42 +6,18 @@ import {
  writeJsonFileAtomically
 } from '../settings-file-utils'

-const MAXIMUM_RECORD_BYTES = 8 * 1024 * 1024
+const MAXIMUM_RECORD_BYTES = 4 * 1024
 const OPERATION_ID_PATTERN =
  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u
 const SHA256_PATTERN = /^[a-f0-9]{64}$/u

-type PendingRemoteEnvironmentOperationBase = {
+export type PendingRemoteEnvironmentOperation = {
+  version: 1
  hostId: string
  targetIdentity: string
  operationId: string
-  size: number
-  sha256: string
-  urls: readonly string[]
 }

-export type PersistedRemoteEnvironmentMetadataSnapshot = {
-  path:
-    | '.goodbuddy/agent/release-keys.json'
-    | '.goodbuddy/agent/registry.json'
-    | '.goodbuddy/runtimes/release-keys.json'
-    | '.goodbuddy/runtimes/remote-runtime-lock.json'
-    | '.goodbuddy/runtimes/registry.json'
-  contentsBase64?: string
-  uid: number
-}
-
-export type PendingRemoteEnvironmentOperation =
-  PendingRemoteEnvironmentOperationBase &
-    (
-      | { version: 1 }
-      | {
-          version: 2
-          metadataSnapshots:
-            readonly PersistedRemoteEnvironmentMetadataSnapshot[]
-        }
-    )
-
 export class RemoteEnvironmentOperationStore {
  readonly #directory: string

@@ -116,27 +92,12 @@ function parsePendingOperation(
    throw new Error('远程环境恢复记录无效')
  }
  const record = value as Record<string, unknown>
-  const version = record.version
-  const expectedKeys = version === 2
-    ? [
-        'hostId',
-        'metadataSnapshots',
-        'operationId',
-        'sha256',
-        'size',
-        'targetIdentity',
-        'urls',
-        'version'
-      ]
-    : [
-        'hostId',
-        'operationId',
-        'sha256',
-        'size',
-        'targetIdentity',
-        'urls',
-        'version'
-      ]
+  const expectedKeys = [
+    'hostId',
+    'operationId',
+    'targetIdentity',
+    'version'
+  ]
  if (
    Object.keys(value).sort().join('\0') !==
      expectedKeys.sort().join('\0')
@@ -144,128 +105,19 @@ function parsePendingOperation(
    throw new Error('远程环境恢复记录无效')
  }
  if (
-    (version !== 1 && version !== 2) ||
+    record.version !== 1 ||
    record.hostId !== expectedHostId ||
    typeof record.targetIdentity !== 'string' ||
    !SHA256_PATTERN.test(record.targetIdentity) ||
    typeof record.operationId !== 'string' ||
-    !OPERATION_ID_PATTERN.test(record.operationId) ||
-    !Number.isSafeInteger(record.size) ||
-    Number(record.size) <= 0 ||
-    typeof record.sha256 !== 'string' ||
-    !SHA256_PATTERN.test(record.sha256) ||
-    !Array.isArray(record.urls) ||
-    record.urls.length > 4 ||
-    record.urls.some(
-      (url) =>
-        typeof url !== 'string' ||
-        Buffer.byteLength(url, 'utf8') > 4_096
-    )
+    !OPERATION_ID_PATTERN.test(record.operationId)
  ) {
    throw new Error('远程环境恢复记录无效')
  }
-  const base: PendingRemoteEnvironmentOperationBase = {
-    hostId: expectedHostId,
-    targetIdentity: record.targetIdentity,
-    operationId: record.operationId,
-    size: Number(record.size),
-    sha256: record.sha256,
-    urls: [...record.urls] as string[]
-  }
-  if (version === 1) {
-    return { version: 1, ...base }
-  }
  return {
-    version: 2,
-    ...base,
-    metadataSnapshots: parseMetadataSnapshots(
-      record.metadataSnapshots
-    )
+    version: 1,
+    hostId: expectedHostId,
+    targetIdentity: record.targetIdentity,
+    operationId: record.operationId
  }
 }
-
-const metadataPaths =
-  new Set<PersistedRemoteEnvironmentMetadataSnapshot['path']>([
-    '.goodbuddy/agent/release-keys.json',
-    '.goodbuddy/agent/registry.json',
-    '.goodbuddy/runtimes/release-keys.json',
-    '.goodbuddy/runtimes/remote-runtime-lock.json',
-    '.goodbuddy/runtimes/registry.json'
-  ])
-
-function parseMetadataSnapshots(
-  value: unknown
-): readonly PersistedRemoteEnvironmentMetadataSnapshot[] {
-  if (!Array.isArray(value) || value.length !== metadataPaths.size) {
-    throw new Error('远程环境恢复记录无效')
-  }
-  const paths = new Set<string>()
-  let totalBytes = 0
-  const snapshots = value.map((item) => {
-    if (
-      typeof item !== 'object' ||
-      item === null ||
-      !(
-        Object.keys(item).sort().join('\0') ===
-          ['path', 'uid'].sort().join('\0') ||
-        Object.keys(item).sort().join('\0') ===
-          ['contentsBase64', 'path', 'uid'].sort().join('\0')
-      )
-    ) {
-      throw new Error('远程环境恢复记录无效')
-    }
-    const snapshot = item as Record<string, unknown>
-    if (
-      typeof snapshot.path !== 'string' ||
-      !metadataPaths.has(
-        snapshot.path as PersistedRemoteEnvironmentMetadataSnapshot['path']
-      ) ||
-      paths.has(snapshot.path) ||
-      !Number.isSafeInteger(snapshot.uid) ||
-      Number(snapshot.uid) < 0
-    ) {
-      throw new Error('远程环境恢复记录无效')
-    }
-    paths.add(snapshot.path)
-    if (snapshot.contentsBase64 === undefined) {
-      return {
-        path:
-          snapshot.path as PersistedRemoteEnvironmentMetadataSnapshot['path'],
-        uid: Number(snapshot.uid)
-      }
-    }
-    if (
-      typeof snapshot.contentsBase64 !== 'string' ||
-      !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u
-        .test(snapshot.contentsBase64)
-    ) {
-      throw new Error('远程环境恢复记录无效')
-    }
-    const contents = Buffer.from(
-      snapshot.contentsBase64,
-      'base64'
-    )
-    if (
-      contents.toString('base64') !==
-        snapshot.contentsBase64 ||
-      contents.byteLength > 1024 * 1024
-    ) {
-      throw new Error('远程环境恢复记录无效')
-    }
-    totalBytes += contents.byteLength
-    return {
-      path:
-        snapshot.path as PersistedRemoteEnvironmentMetadataSnapshot['path'],
-      contentsBase64: snapshot.contentsBase64,
-      uid: Number(snapshot.uid)
-    }
-  })
-  if (
-    paths.size !== metadataPaths.size ||
-    [...metadataPaths].some((path) => !paths.has(path)) ||
-    totalBytes > 5 * 1024 * 1024
-  ) {
-    throw new Error('远程环境恢复记录无效')
-  }
-  return snapshots
-}
@@ -4,12 +4,10 @@ import {
  SshRemotePackageCommitIndeterminateError,
  type SshRemotePackageIdentity
 } from '../ssh/ssh-remote-package-bootstrap'
-import type { StagedSftp } from '../ssh/bounded-sftp'
 import type {
  AgentPackageArchiveLease,
  VerifiedRemoteAgentInstallCandidate
 } from './agent-package-manager'
-import { REMOTE_ENVIRONMENT_METADATA_PATHS } from './remote-environment-metadata'
 import type {
  PendingRemoteEnvironmentOperation
 } from './remote-environment-operation-store'
@@ -100,72 +98,13 @@ type FixtureOptions = {
  prepare?: ReturnType<typeof vi.fn>
  prepareUploaded?: ReturnType<typeof vi.fn>
  commit?: ReturnType<typeof vi.fn>
-  commitStatus?: ReturnType<typeof vi.fn>
  cleanup?: ReturnType<typeof vi.fn>
  uploadFile?: ReturnType<typeof vi.fn>
  activateAgent?: ReturnType<typeof vi.fn>
  activateRuntime?: ReturnType<typeof vi.fn>
-  metadataFiles?: Map<string, Buffer>
-  metadataReplaceFailure?: Error
  pendingOperation?: PendingRemoteEnvironmentOperation
 }

-function missingPath(): Error & { code: string } {
-  return Object.assign(new Error('missing'), { code: 'ENOENT' })
-}
-
-function metadataSftp(
-  files: Map<string, Buffer>,
-  calls: string[],
-  replaceFailure?: Error
-): StagedSftp {
-  const temporary = new Map<string, Buffer>()
-  return {
-    stagingDirectory: '/home/goodbuddy',
-    mkdir: vi.fn(),
-    uploadFile: vi.fn(),
-    writeFile: vi.fn(async (path: string, contents: Buffer) => {
-      temporary.set(path, Buffer.from(contents))
-    }),
-    readFile: vi.fn(async (path: string) => {
-      const contents = files.get(path) ?? temporary.get(path)
-      if (!contents) throw missingPath()
-      return Buffer.from(contents)
-    }),
-    lstat: vi.fn(async (path: string) => {
-      const contents = files.get(path) ?? temporary.get(path)
-      if (!contents) throw missingPath()
-      return {
-        type: 'file' as const,
-        size: contents.byteLength,
-        mode: 0o600,
-        uid: 1000,
-        gid: 1000,
-        atime: 0,
-        mtime: 0
-      }
-    }),
-    stat: vi.fn(),
-    chmod: vi.fn(),
-    setExecutable: vi.fn(),
-    rename: vi.fn(),
-    replaceFile: vi.fn(async (source: string, destination: string) => {
-      if (replaceFailure) throw replaceFailure
-      const contents = temporary.get(source)
-      if (!contents) throw missingPath()
-      files.set(destination, contents)
-      temporary.delete(source)
-    }),
-    unlink: vi.fn(async (path: string) => {
-      if (!files.delete(path) && !temporary.delete(path)) {
-        throw missingPath()
-      }
-    }),
-    rmdir: vi.fn(),
-    close: vi.fn(() => calls.push('close-metadata'))
-  }
-}
-
 function fixture(options: FixtureOptions = {}) {
  const calls: string[] = []
  const targets = options.targets ?? [target()]
@@ -182,12 +121,6 @@ function fixture(options: FixtureOptions = {}) {
    hostKeyGeneration: targets[0]!.hostKeyGeneration,
    authenticationIdentity: '3'.repeat(64)
  }
-  const metadataFiles = options.metadataFiles ?? new Map<string, Buffer>()
-  const metadata = metadataSftp(
-    metadataFiles,
-    calls,
-    options.metadataReplaceFailure
-  )
  const uploadFile = options.uploadFile ?? vi.fn(async (
    path: string
  ) => {
@@ -202,14 +135,6 @@ function fixture(options: FixtureOptions = {}) {
    close: vi.fn(() => calls.push('close-upload'))
  }
  const regularRelease = vi.fn(() => calls.push('release-probe'))
-  const stopCandidate = vi.fn(async (
-    _installationId?: string,
-    _action?: string
-  ) => {
-    void _installationId
-    void _action
-    calls.push('stop-candidate')
-  })
  const activateAgent = options.activateAgent ?? vi.fn(async () => {
    calls.push('agent')
    return { exitCode: 0, stdout: '{}', stderr: '' }
@@ -233,27 +158,17 @@ function fixture(options: FixtureOptions = {}) {
        procfs: 'ready'
      }
    }),
-    openStagedSftp: vi.fn(async (root: string) => {
-      if (root.includes('install-operations')) {
-        calls.push('open-upload')
-        return uploadSftp
-      }
-      calls.push('open-metadata')
-      return metadata
+    openStagedSftp: vi.fn(async () => {
+      calls.push('open-upload')
+      return uploadSftp
    }),
    runAgentLifecycleAction: vi.fn(async (
      installationId: string,
      action: string
-    ) => {
-      if (action === 'stop') {
-        await stopCandidate(installationId, action)
-        return { exitCode: 0, stdout: '{}', stderr: '' }
-      }
-      return (activateAgent as (
+    ) => (activateAgent as (
        installationId: string,
        action: string
-      ) => Promise<unknown>)(installationId, action)
-    }),
+      ) => Promise<unknown>)(installationId, action)),
    runAgentRuntimeAction: vi.fn(async (
      installationId: string,
      action: unknown
@@ -302,13 +217,6 @@ function fixture(options: FixtureOptions = {}) {
    calls.push('cleanup')
    return { cleaned: true, operationId }
  })
-  const commitStatus = options.commitStatus ?? vi.fn(async (
-    input: { operationId: string }
-  ) => ({
-    committed: true,
-    operationId: input.operationId,
-    identity
-  }))
  const bootstrapRelease = vi.fn(() => calls.push('release-bootstrap'))
  const probe = vi.fn(async () => {
    calls.push('method-probe')
@@ -337,7 +245,6 @@ function fixture(options: FixtureOptions = {}) {
    prepare,
    prepareUploaded,
    commit,
-    commitStatus,
    cleanup,
    release: bootstrapRelease
  }
@@ -402,8 +309,6 @@ function fixture(options: FixtureOptions = {}) {
    resolver,
    regularLease,
    bootstrapLease,
-    metadata,
-    metadataFiles,
    uploadFile,
    probe,
    createUploadStaging,
@@ -417,8 +322,6 @@ function fixture(options: FixtureOptions = {}) {
    archiveRelease,
    regularRelease,
    bootstrapRelease,
-    stopCandidate,
-    commitStatus,
    operationStore
  }
 }
@@ -445,15 +348,12 @@ describe('RemoteEnvironmentPreparer', () => {
      'acquire-bootstrap',
      'save-operation',
      'prepare',
-      'open-metadata',
-      'save-operation',
      'resolve',
      'commit',
      'agent',
      'runtime',
      'cleanup',
      'remove-operation',
-      'close-metadata',
      'release-bootstrap',
      'release-probe'
    ])
@@ -483,7 +383,7 @@ describe('RemoteEnvironmentPreparer', () => {
      remoteCandidate.operationId,
      { signal: controller.signal }
    )
-    expect(value.operationStore.save).toHaveBeenCalledTimes(2)
+    expect(value.operationStore.save).toHaveBeenCalledOnce()
    expect(value.operationStore.remove).toHaveBeenCalledOnce()
    expect(progress.some((event) =>
      event.method === 'remote-download' &&
@@ -532,7 +432,6 @@ describe('RemoteEnvironmentPreparer', () => {
    )).resolves.toBeUndefined()
    expect(value.activateAgent).toHaveBeenCalledOnce()
    expect(value.activateRuntime).toHaveBeenCalledOnce()
-    expect(value.stopCandidate).not.toHaveBeenCalled()
    expect(value.operationStore.remove).not.toHaveBeenCalled()
  })

@@ -725,13 +624,13 @@ describe('RemoteEnvironmentPreparer', () => {
      new AbortController().signal
    )).rejects.toBeInstanceOf(SshRemotePackageCommitIndeterminateError)
    expect(value.cleanup).not.toHaveBeenCalled()
-    expect(value.operationStore.save).toHaveBeenCalledTimes(2)
+    expect(value.operationStore.save).toHaveBeenCalledOnce()
    expect(value.operationStore.remove).not.toHaveBeenCalled()
    expect(value.activateAgent).not.toHaveBeenCalled()
    expect(value.activateRuntime).not.toHaveBeenCalled()
  })

-  it('rolls metadata back when cancellation arrives with a successful commit result', async () => {
+  it('cleans staging when cancellation arrives with a successful commit result', async () => {
    const controller = new AbortController()
    const cancellation =
      new DOMException('cancelled after commit', 'AbortError')
@@ -752,7 +651,6 @@ describe('RemoteEnvironmentPreparer', () => {
      undefined,
      controller.signal
    )).rejects.toBe(cancellation)
-    expect(value.stopCandidate).toHaveBeenCalledOnce()
    expect(value.cleanup).toHaveBeenCalledOnce()
    expect(value.operationStore.remove).toHaveBeenCalledOnce()
    expect(value.activateAgent).not.toHaveBeenCalled()
@@ -778,61 +676,7 @@ describe('RemoteEnvironmentPreparer', () => {
    expect(value.operationStore.remove).not.toHaveBeenCalled()
  })

-  it('resumes adoption for a committed operation instead of reinstalling it', async () => {
-    const pendingOperationId =
-      '00000000-0000-4000-8000-000000000777'
-    const originalTarget = target()
-    const renamedTarget = target({
-      host: {
-        ...originalTarget.host,
-        name: 'Renamed builder'
-      },
-      hostRevision: 99
-    })
-    const value = fixture({
-      targets: [renamedTarget],
-      pendingOperation: {
-        version: 2,
-        hostId: HOST_ID,
-        targetIdentity:
-          remoteHostRecoveryIdentityKey(originalTarget),
-        operationId: pendingOperationId,
-        size: candidate.size,
-        sha256: candidate.sha256,
-        urls: candidate.urls,
-        metadataSnapshots:
-          REMOTE_ENVIRONMENT_METADATA_PATHS.map(
-            (path) => ({
-              path,
-              uid: 1000
-            })
-          )
-      }
-    })
-
-    await value.preparer.prepare(
-      HOST_ID,
-      'remote-download',
-      undefined,
-      new AbortController().signal
-    )
-
-    expect(value.commitStatus).toHaveBeenCalledWith(
-      expect.objectContaining({
-        operationId: pendingOperationId
-      }),
-      expect.any(Object)
-    )
-    expect(value.cleanup.mock.calls[0]?.[0]).toBe(
-      pendingOperationId
-    )
-    expect(value.activateAgent).toHaveBeenCalledOnce()
-    expect(value.activateRuntime).toHaveBeenCalledOnce()
-    expect(value.prepare).not.toHaveBeenCalled()
-    expect(value.operationStore.remove).toHaveBeenCalledOnce()
-  })
-
-  it('cleans a legacy pending operation and starts a fresh authenticated prepare', async () => {
+  it('cleans pending staging and starts a fresh authenticated prepare', async () => {
    const originalTarget = target()
    const pendingOperationId =
      '00000000-0000-4000-8000-000000000780'
@@ -843,10 +687,7 @@ describe('RemoteEnvironmentPreparer', () => {
        hostId: HOST_ID,
        targetIdentity:
          remoteHostRecoveryIdentityKey(originalTarget),
-        operationId: pendingOperationId,
-        size: candidate.size,
-        sha256: candidate.sha256,
-        urls: candidate.urls
+        operationId: pendingOperationId
      }
    })

@@ -857,7 +698,6 @@ describe('RemoteEnvironmentPreparer', () => {
      new AbortController().signal
    )

-    expect(value.commitStatus).not.toHaveBeenCalled()
    expect(value.cleanup.mock.calls[0]?.[0]).toBe(
      pendingOperationId
    )
@@ -865,104 +705,30 @@ describe('RemoteEnvironmentPreparer', () => {
    expect(value.operationStore.remove).toHaveBeenCalledTimes(2)
  })

-  it('restores the durable snapshot when resumed commit does not complete', async () => {
+  it('does not block a fresh prepare when stale staging cleanup fails', async () => {
    const originalTarget = target()
-    const originals = new Map<string, Buffer>(
-      REMOTE_ENVIRONMENT_METADATA_PATHS.map(
-        (path, index) => [
-          path,
-          Buffer.from(`before-commit-${index}`)
-        ]
-      )
-    )
-    const files = new Map<string, Buffer>(
-      REMOTE_ENVIRONMENT_METADATA_PATHS.map(
-        (path) => [path, Buffer.from('partial-commit')]
-      )
-    )
+    let cleanupCalls = 0
    const value = fixture({
      targets: [originalTarget],
-      metadataFiles: files,
      pendingOperation: {
-        version: 2,
+        version: 1,
        hostId: HOST_ID,
        targetIdentity:
          remoteHostRecoveryIdentityKey(originalTarget),
        operationId:
-          '00000000-0000-4000-8000-000000000781',
-        size: candidate.size,
-        sha256: candidate.sha256,
-        urls: candidate.urls,
-        metadataSnapshots: [...originals].map(
-          ([path, contents]) => ({
-            path: path as never,
-            uid: 1000,
-            contentsBase64: contents.toString('base64')
-          })
-        )
+          '00000000-0000-4000-8000-000000000779'
      },
-      commitStatus: vi.fn(async () => ({
-        committed: false,
-        reason: 'installer-failed'
-      }))
-    })
-
-    await value.preparer.prepare(
-      HOST_ID,
-      'remote-download',
-      undefined,
-      new AbortController().signal
-    )
-
-    expect([...files]).toEqual([...originals])
-    expect(value.prepare).toHaveBeenCalledOnce()
-  })
-
-  it('restores persisted pre-commit metadata when resumed Runtime adoption fails', async () => {
-    const originalTarget = target()
-    const originals = new Map<string, Buffer>(
-      REMOTE_ENVIRONMENT_METADATA_PATHS.map(
-        (path, index) => [
-          path,
-          Buffer.from(`original-${index}`)
-        ]
-      )
-    )
-    const files = new Map<string, Buffer>(
-      REMOTE_ENVIRONMENT_METADATA_PATHS.map(
-        (path) => [path, Buffer.from('published')]
-      )
-    )
-    const runtimeFailure = new Error('runtime recovery failed')
-    const value = fixture({
-      targets: [originalTarget],
-      metadataFiles: files,
-      pendingOperation: {
-        version: 2,
-        hostId: HOST_ID,
-        targetIdentity:
-          remoteHostRecoveryIdentityKey(originalTarget),
-        operationId:
-          '00000000-0000-4000-8000-000000000779',
-        size: candidate.size,
-        sha256: candidate.sha256,
-        urls: candidate.urls,
-        metadataSnapshots: [...originals].map(
-          ([path, contents]) => ({
-            path: path as never,
-            uid: 1000,
-            contentsBase64: contents.toString('base64')
-          })
-        )
-      },
-      activateAgent: vi.fn(async () => {
-        for (const path of REMOTE_ENVIRONMENT_METADATA_PATHS) {
-          files.set(path, Buffer.from('adopting'))
-        }
-        return { exitCode: 0, stdout: '{}', stderr: '' }
-      }),
-      activateRuntime: vi.fn(async () => {
-        throw runtimeFailure
+      cleanup: vi.fn(async (operationId: string) => {
+        cleanupCalls += 1
+        return cleanupCalls === 1
+          ? {
+              cleaned: false as const,
+              reason: 'cleanup-failed' as const
+            }
+          : {
+              cleaned: true as const,
+              operationId
+            }
      })
    })

@@ -971,14 +737,14 @@ describe('RemoteEnvironmentPreparer', () => {
      'remote-download',
      undefined,
      new AbortController().signal
-    )).rejects.toThrow('runtime recovery failed')
-    expect([...files]).toEqual([...originals])
-    expect(value.stopCandidate).toHaveBeenCalledOnce()
-    expect(value.cleanup).not.toHaveBeenCalled()
-    expect(value.operationStore.remove).not.toHaveBeenCalled()
+    )).resolves.toBeUndefined()
+
+    expect(value.prepare).toHaveBeenCalledOnce()
+    expect(value.cleanup).toHaveBeenCalledTimes(2)
+    expect(value.operationStore.remove).toHaveBeenCalledTimes(2)
  })

-  it('retains pending recovery evidence when the real SSH target changes', async () => {
+  it('drops stale cleanup state when the SSH target changed and starts fresh', async () => {
    const originalTarget = target()
    const changedTarget = target({
      host: {
@@ -986,6 +752,8 @@ describe('RemoteEnvironmentPreparer', () => {
        hostname: 'different.example'
      }
    })
+    const pendingOperationId =
+      '00000000-0000-4000-8000-000000000778'
    const value = fixture({
      targets: [changedTarget],
      pendingOperation: {
@@ -993,45 +761,27 @@ describe('RemoteEnvironmentPreparer', () => {
        hostId: HOST_ID,
        targetIdentity:
          remoteHostRecoveryIdentityKey(originalTarget),
-        operationId:
-          '00000000-0000-4000-8000-000000000778',
-        size: candidate.size,
-        sha256: candidate.sha256,
-        urls: candidate.urls
+        operationId: pendingOperationId
      }
    })

-    await expect(value.preparer.prepare(
+    await value.preparer.prepare(
      HOST_ID,
      'remote-download',
      undefined,
      new AbortController().signal
-    )).rejects.toBeInstanceOf(
-      SshRemotePackageCommitIndeterminateError
    )
-    expect(value.commitStatus).not.toHaveBeenCalled()
-    expect(value.operationStore.remove).not.toHaveBeenCalled()
+
+    expect(value.prepare).toHaveBeenCalledOnce()
+    expect(value.cleanup.mock.calls.some(
+      (call) => call[0] === pendingOperationId
+    )).toBe(false)
+    expect(value.operationStore.remove).toHaveBeenCalledTimes(2)
  })

-  it('stops the committed Agent and restores all five metadata files when Runtime adoption fails', async () => {
-    const originals = new Map<string, Buffer>()
-    for (const [index, path] of REMOTE_ENVIRONMENT_METADATA_PATHS.entries()) {
-      if (index !== 2) originals.set(path, Buffer.from(`original-${index}`))
-    }
-    const files = new Map(
-      [...originals].map(([path, contents]) => [path, Buffer.from(contents)])
-    )
-    const runtimeFailure = new Error('runtime health failed')
+  it('cleans staging and leaves a fresh retry after Runtime adoption fails', async () => {
+    const runtimeFailure = new Error('runtime failed')
    const value = fixture({
-      metadataFiles: files,
-      activateAgent: vi.fn(async () => {
-        value.calls.push('agent')
-        value.metadataFiles.clear()
-        for (const path of REMOTE_ENVIRONMENT_METADATA_PATHS) {
-          value.metadataFiles.set(path, Buffer.from('new'))
-        }
-        return { exitCode: 0, stdout: '{}', stderr: '' }
-      }),
      activateRuntime: vi.fn(async () => {
        throw runtimeFailure
      })
@@ -1043,42 +793,7 @@ describe('RemoteEnvironmentPreparer', () => {
      undefined,
      new AbortController().signal
    )).rejects.toBe(runtimeFailure)
-    expect(value.stopCandidate).toHaveBeenCalledWith(
-      identity.agent.installationId,
-      'stop'
-    )
-    expect([...value.metadataFiles]).toEqual([...originals])
    expect(value.cleanup).toHaveBeenCalledOnce()
-  })
-
-  it('throws AggregateError when adoption and metadata rollback both fail', async () => {
-    const path = REMOTE_ENVIRONMENT_METADATA_PATHS[0]
-    const files = new Map([[path, Buffer.from('original')]])
-    const runtimeFailure = new Error('runtime failed')
-    const rollbackFailure = new Error('replace failed')
-    const value = fixture({
-      metadataFiles: files,
-      metadataReplaceFailure: rollbackFailure,
-      activateAgent: vi.fn(async () => {
-        files.set(path, Buffer.from('changed'))
-        return { exitCode: 0, stdout: '{}', stderr: '' }
-      }),
-      activateRuntime: vi.fn(async () => {
-        throw runtimeFailure
-      })
-    })
-
-    const caught = await value.preparer.prepare(
-      HOST_ID,
-      'remote-download',
-      undefined,
-      new AbortController().signal
-    ).catch((error: unknown) => error)
-    expect(caught).toBeInstanceOf(AggregateError)
-    expect((caught as AggregateError).errors[0]).toBe(runtimeFailure)
-    expect((caught as AggregateError).errors[1]).toBeInstanceOf(
-      AggregateError
-    )
-    expect(value.stopCandidate).toHaveBeenCalledOnce()
+    expect(value.operationStore.remove).toHaveBeenCalledOnce()
  })
 })
@@ -5,7 +5,6 @@ import type {
  RemoteEnvironmentPreparationMethod,
  RemoteEnvironmentUpdateProgress
 } from '../../shared/ssh-host-contracts'
-import type { StagedSftp } from '../ssh/bounded-sftp'
 import { verifyAgentInstallationId } from '../ssh/ssh-agent-command'
 import type {
  AgentDiagnosticResult,
@@ -33,13 +32,8 @@ import type {
  AgentPackageManager,
  VerifiedRemoteAgentInstallCandidate
 } from './agent-package-manager'
-import {
-  restoreRemoteEnvironmentMetadata,
-  snapshotRemoteEnvironmentMetadata,
-  type RemoteEnvironmentMetadataSnapshot
-} from './remote-environment-metadata'
 import type {
-  PersistedRemoteEnvironmentMetadataSnapshot,
+  PendingRemoteEnvironmentOperation,
  RemoteEnvironmentOperationStore
 } from './remote-environment-operation-store'
 import type {
@@ -52,7 +46,6 @@ import {
 import { boundedDiagnostic } from './bounded-diagnostic'

 const MAXIMUM_PACKAGE_BYTES = 512 * 1024 * 1024
-const MAXIMUM_METADATA_BYTES = 1024 * 1024
 const MAXIMUM_DIAGNOSTIC_CHARACTERS = 800

 function assertAgentCommandSucceeded(
@@ -95,7 +88,7 @@ export type RemoteEnvironmentPreparerOptions = {
 /**
 * Prepares one signed compound environment. The selected method controls only
 * how the archive reaches the Host; both paths share prepare, commit,
- * activation, rollback, health checks, and cleanup.
+ * activation, health checks, and cleanup.
 */
 export class RemoteEnvironmentPreparer implements Preparer {
  readonly #resolver: AgentInstallationTargetResolver
@@ -134,29 +127,21 @@ export class RemoteEnvironmentPreparer implements Preparer {
    const target = await this.#resolver.resolve(hostId)
    signal.throwIfAborted()
    assertValidSshConnectionTarget(hostId, target)
-    const recovered = await this.#reconcilePendingOperation(
+    await this.#cleanupPendingOperation(
      hostId,
      target,
      emit,
      signal
    )
-    if (recovered) {
-      return
-    }

    let probeLease: SshConnectionLease | undefined
    let bootstrapLease:
      | SshRemotePackageBootstrapLease
      | undefined
    let archiveLease: AgentPackageArchiveLease | undefined
-    let metadataSftp: StagedSftp | undefined
-    let metadataSnapshots:
-      | readonly RemoteEnvironmentMetadataSnapshot[]
-      | undefined
    let operationId: string | undefined
    let operationCleaned = false
    let pendingOperationSaved = false
-    let committedIdentity: SshRemotePackageIdentity | undefined
    try {
      probeLease = await this.#sshPool.acquire(target, signal)
      assertLeaseMatchesTarget(probeLease, target)
@@ -256,16 +241,13 @@ export class RemoteEnvironmentPreparer implements Preparer {
      }
      emit(method, 'probing')

-      // Persist recovery identity before either preparation path may create
-      // remote staging. A Main crash must never leave an untracked operation.
+      // Keep only the operation ID needed to clean stale staging before the
+      // next fresh attempt. No remote environment state is copied locally.
      await this.#operationStore.save({
        version: 1,
        hostId,
        targetIdentity: remoteHostRecoveryIdentityKey(target),
-        operationId,
-        size: remoteCandidate.size,
-        sha256: remoteCandidate.sha256,
-        urls: [...remoteCandidate.urls]
+        operationId
      })
      pendingOperationSaved = true

@@ -289,35 +271,6 @@ export class RemoteEnvironmentPreparer implements Preparer {
      assertPrepared(prepared, operationId)
      assertPackageIdentity(prepared.identity, candidate)

-      // Snapshot the complete environment before commit so an Agent success
-      // followed by a Runtime failure cannot expose a partially adopted pair.
-      metadataSftp = await probeLease.openStagedSftp(
-        probe.canonicalHomeDirectory,
-        {
-          maximumFileBytes: MAXIMUM_METADATA_BYTES,
-          maximumTotalBytes: MAXIMUM_METADATA_BYTES * 24,
-          maximumOperations: 128
-        },
-        signal
-      )
-      metadataSnapshots =
-        await snapshotRemoteEnvironmentMetadata(
-          metadataSftp,
-          probe.uid,
-          signal
-        )
-      await this.#operationStore.save({
-        version: 2,
-        hostId,
-        targetIdentity: remoteHostRecoveryIdentityKey(target),
-        operationId,
-        size: remoteCandidate.size,
-        sha256: remoteCandidate.sha256,
-        urls: [...remoteCandidate.urls],
-        metadataSnapshots:
-          persistMetadataSnapshots(metadataSnapshots)
-      })
-
      // Keep the full target re-resolution immediately adjacent to commit.
      await assertTargetCurrent(this.#resolver, target, signal)
      assertLeaseMatchesTarget(bootstrapLease, target)
@@ -355,7 +308,6 @@ export class RemoteEnvironmentPreparer implements Preparer {
        throw new Error('远端安装提交身份与准备身份不匹配')
      }
      assertPackageIdentity(committed.identity, candidate)
-      committedIdentity = committed.identity
      signal.throwIfAborted()

      await this.#adoptCommittedEnvironment(
@@ -372,7 +324,10 @@ export class RemoteEnvironmentPreparer implements Preparer {
          operationId,
          { signal }
        )
-        if (cleanup.cleaned) {
+        if (
+          cleanup.cleaned ||
+          cleanup.reason === 'operation-unavailable'
+        ) {
          operationCleaned = true
          try {
            await this.#operationStore.remove(hostId)
@@ -381,29 +336,10 @@ export class RemoteEnvironmentPreparer implements Preparer {
          }
        }
      } catch {
-        // The environment is already healthy. Leave the bounded
-        // operation for a later maintenance retry.
+        // The environment is already healthy. The next update will retry
+        // cleanup before starting a fresh operation.
      }
    } catch (error) {
-      let rollbackError: unknown
-      if (
-        committedIdentity &&
-        metadataSftp &&
-        metadataSnapshots
-      ) {
-        await stopCandidateBestEffort(
-          probeLease,
-          committedIdentity.agent.installationId
-        )
-        try {
-          await restoreRemoteEnvironmentMetadata(
-            metadataSftp,
-            metadataSnapshots
-          )
-        } catch (reason) {
-          rollbackError = reason
-        }
-      }
      if (
        operationId &&
        bootstrapLease &&
@@ -415,19 +351,11 @@ export class RemoteEnvironmentPreparer implements Preparer {
          operationId
        )
        if (operationCleaned && pendingOperationSaved) {
-          await this.#operationStore.remove(hostId)
+          await this.#operationStore.remove(hostId).catch(() => undefined)
        }
      }
-      if (rollbackError) {
-        throw new AggregateError(
-          [error, rollbackError],
-          '远程运行环境准备失败，且原有环境元数据未能完整恢复',
-          { cause: error }
-        )
-      }
      throw error
    } finally {
-      metadataSftp?.close()
      archiveLease?.release()
      bootstrapLease?.release()
      probeLease?.release()
@@ -595,7 +523,7 @@ export class RemoteEnvironmentPreparer implements Preparer {
    )
  }

-  async #reconcilePendingOperation(
+  async #cleanupPendingOperation(
    hostId: string,
    target: SshConnectionTarget,
    emit: (
@@ -603,207 +531,46 @@ export class RemoteEnvironmentPreparer implements Preparer {
      phase: RemoteEnvironmentUpdateProgress['phase']
    ) => void,
    signal: AbortSignal
-  ): Promise<boolean> {
-    const pending = await this.#operationStore.load(hostId)
+  ): Promise<void> {
+    let pending: PendingRemoteEnvironmentOperation | undefined
+    try {
+      pending = await this.#operationStore.load(hostId)
+    } catch {
+      await this.#operationStore.remove(hostId)
+      return
+    }
    if (!pending) {
-      return false
+      return
    }
    if (
      pending.targetIdentity !==
      remoteHostRecoveryIdentityKey(target)
    ) {
-      throw new SshRemotePackageCommitIndeterminateError(
-        'SSH Host 连接目标已变化，无法确认上一次远程环境提交；请恢复原 Host 连接后重试，或删除此 Host 以明确放弃恢复'
-      )
+      await this.#operationStore.remove(hostId)
+      return
    }
    emit('auto', 'applying')
-    const candidate: SshRemotePackageCandidate = {
-      operationId: pending.operationId,
-      size: pending.size,
-      sha256: pending.sha256,
-      urls: pending.urls
-    }
    const bootstrapLease =
      await this.#sshPool.acquireRemotePackageBootstrap(
        target,
        signal
-      )
-    let commandLease: SshConnectionLease | undefined
-    let recoveryMetadataSftp: StagedSftp | undefined
+      ).catch(() => undefined)
    try {
+      if (!bootstrapLease) {
+        return
+      }
      assertLeaseMatchesTarget(bootstrapLease, target)
-      if (pending.version === 1) {
-        const cleanup = await bootstrapLease.cleanup(
-          pending.operationId,
-          { signal }
-        )
-        if (
-          !cleanup.cleaned &&
-          cleanup.reason !== 'operation-unavailable'
-        ) {
-          throw new Error(
-            `旧版远程环境暂存清理失败：${cleanup.reason}`
-          )
-        }
-        await this.#operationStore.remove(hostId)
-        return false
-      }
-      const status = await bootstrapLease.commitStatus(
-        candidate,
-        { signal }
-      )
-      if (
-        !status.committed &&
-        status.reason === 'operation-unavailable'
-      ) {
-        await this.#operationStore.remove(hostId)
-        return false
-      }
-      if (
-        !status.committed &&
-        status.reason === 'installer-rollback-incomplete'
-      ) {
-        throw new SshRemotePackageCommitIndeterminateError(
-          '上一次远程环境发布失败且回滚结果不完整，请检查 Host 状态'
-        )
-      }
-      commandLease = await this.#sshPool.acquire(
-        target,
-        signal
-      )
-      assertLeaseMatchesTarget(commandLease, target)
-      const probe =
-        await commandLease.runAgentBootstrapProbe(signal)
-      if (!probe.ready) {
-        throw new Error(
-          `远端系统不能恢复 GoodBuddy 环境：${probe.reason}`
-        )
-      }
-      recoveryMetadataSftp =
-        await commandLease.openStagedSftp(
-          probe.canonicalHomeDirectory,
-          {
-            maximumFileBytes: MAXIMUM_METADATA_BYTES,
-            maximumTotalBytes:
-              MAXIMUM_METADATA_BYTES * 24,
-            maximumOperations: 128
-          },
-          signal
-        )
-      const recoverySnapshots =
-        restorePersistedMetadataSnapshots(
-          pending.metadataSnapshots,
-          probe.uid
-        )
-      if (status.committed) {
-        try {
-          await this.#adoptCommittedEnvironment(
-            commandLease,
-            status.identity,
-            'auto',
-            emit,
-            signal
-          )
-        } catch (error) {
-          await stopCandidateBestEffort(
-            commandLease,
-            status.identity.agent.installationId
-          )
-          try {
-            await restoreRemoteEnvironmentMetadata(
-              recoveryMetadataSftp,
-              recoverySnapshots
-            )
-          } catch (rollbackError) {
-            throw new AggregateError(
-              [error, rollbackError],
-              '上一次远程环境恢复失败，且原有环境元数据未能完整恢复',
-              { cause: rollbackError }
-            )
-          }
-          throw error
-        }
-      } else {
-        await restoreRemoteEnvironmentMetadata(
-          recoveryMetadataSftp,
-          recoverySnapshots
-        )
-      }
-      const cleanup = await bootstrapLease.cleanup(
+      await bootstrapLease.cleanup(
        pending.operationId,
        { signal }
-      )
-      if (
-        cleanup.cleaned ||
-        cleanup.reason === 'operation-unavailable'
-      ) {
-        await this.#operationStore.remove(hostId)
-      } else if (!status.committed) {
-        throw new Error(
-          `上一次未提交的远程环境暂存清理失败：${cleanup.reason}`
-        )
-      }
-      return status.committed
-    } catch (error) {
-      if (
-        error instanceof
-        SshRemotePackageCommitIndeterminateError
-      ) {
-        throw error
-      }
-      const detail = error instanceof Error
-        ? error.message
-        : String(error)
-      throw new SshRemotePackageCommitIndeterminateError(
-        `上一次远程环境恢复失败：${detail}`
-      )
+      ).catch(() => undefined)
    } finally {
-      recoveryMetadataSftp?.close()
-      commandLease?.release()
-      bootstrapLease.release()
+      bootstrapLease?.release()
+      await this.#operationStore.remove(hostId)
    }
  }
 }

-function persistMetadataSnapshots(
-  snapshots: readonly RemoteEnvironmentMetadataSnapshot[]
-): readonly PersistedRemoteEnvironmentMetadataSnapshot[] {
-  return snapshots.map((snapshot) => ({
-    path: snapshot.path,
-    uid: snapshot.uid,
-    ...(snapshot.contents === undefined
-      ? {}
-      : {
-          contentsBase64:
-            snapshot.contents.toString('base64')
-        })
-  }))
-}
-
-function restorePersistedMetadataSnapshots(
-  snapshots:
-    readonly PersistedRemoteEnvironmentMetadataSnapshot[],
-  uid: number
-): readonly RemoteEnvironmentMetadataSnapshot[] {
-  if (snapshots.some((snapshot) => snapshot.uid !== uid)) {
-    throw new Error(
-      '远程环境恢复元数据与当前 SSH 用户不匹配'
-    )
-  }
-  return snapshots.map((snapshot) => ({
-    path: snapshot.path,
-    uid: snapshot.uid,
-    ...(snapshot.contentsBase64 === undefined
-      ? {}
-      : {
-          contents: Buffer.from(
-            snapshot.contentsBase64,
-            'base64'
-          )
-        })
-  }))
-}
-
 async function resolvePreparationMethod(
  requested: RemoteEnvironmentPreparationMethod,
  lease: SshRemotePackageBootstrapLease,
@@ -854,23 +621,6 @@ async function cleanupBestEffort(
  }
 }

-async function stopCandidateBestEffort(
-  lease: SshConnectionLease | undefined,
-  installationId: string
-): Promise<void> {
-  if (!lease?.isUsable()) {
-    return
-  }
-  try {
-    await lease.runAgentLifecycleAction(
-      verifyAgentInstallationId(installationId),
-      'stop'
-    )
-  } catch {
-    // Metadata rollback remains the authoritative recovery action.
-  }
-}
-
 async function assertTargetCurrent(
  resolver: AgentInstallationTargetResolver,
  expected: SshConnectionTarget,
@@ -1,12 +1,7 @@
-import {
-  readFileSync,
-  readdirSync
-} from 'node:fs'
-import {
-  join,
-  resolve
-} from 'node:path'
 import { describe, expect, it, vi } from 'vitest'
+import type {
+  RemoteRuntimeBundleManifest
+} from '../../shared/remote-runtime-launch-contracts'
 import type {
  SshConnectionPoolTarget
 } from '../ssh/ssh-connection-pool'
@@ -17,24 +12,62 @@ import {

 const HOST_ID = 'host-1'
 const AGENT_ID = `agent-${'a'.repeat(64)}` as never
-const runtimeRoot = resolve(
-  '.remote-runtime-resources',
-  'linux-x64',
-  'opencode'
-)
-const digestDirectory = readdirSync(runtimeRoot)[0]!
-const manifest = JSON.parse(
-  readFileSync(
-    join(runtimeRoot, digestDirectory, 'manifest.json'),
-    'utf8'
-  )
-) as {
-  runtimeId: string
-  runtimeVersion: string
-  architecture: 'x64'
-  bundleDigest: string
-  adapterDigest: string
-  acpCapabilitiesDigest: string
+const digestDirectory = 'a'.repeat(64)
+const manifest: RemoteRuntimeBundleManifest = {
+  formatVersion: 2,
+  product: 'GoodBuddy',
+  runtimeId: 'opencode',
+  runtimeVersion: '1.18.9',
+  provider: 'opencode',
+  platform: 'linux',
+  architecture: 'x64',
+  signingKeyId: 'runtime-test',
+  bundleDigest: `sha256:${digestDirectory}`,
+  adapterDigest: `sha256:${'b'.repeat(64)}`,
+  sourcePackage: {
+    name: 'opencode-linux-x64-baseline',
+    integrity:
+      'sha512-x4KiJk9EF7ktM18Ru5Jue4kTntxMvlhWb7tHniQGGRvY2KeoK1iIkyAFd7ri5H/fSkM22hNv/Gg1Jk6/h9IlxQ=='
+  },
+  entrypoint: {
+    identity: 'opencode-acp',
+    path: 'bin/opencode',
+    sha256: 'c'.repeat(64),
+    argvPrefix: ['acp']
+  },
+  files: [
+    {
+      path: 'bin/opencode',
+      size: 100,
+      sha256: 'c'.repeat(64),
+      mode: '0755'
+    },
+    {
+      path: 'licenses/opencode.txt',
+      size: 10,
+      sha256: 'd'.repeat(64),
+      mode: '0644'
+    }
+  ],
+  licenses: [
+    {
+      package: 'opencode',
+      version: '1.18.9',
+      spdx: 'MIT',
+      path: 'licenses/opencode.txt'
+    }
+  ],
+  allowedEnvironmentNames: ['HOME', 'LANG'],
+  protocol: {
+    major: 2,
+    minor: 0
+  },
+  acpCapabilitiesDigest: `sha256:${'e'.repeat(64)}`,
+  limits: {
+    maximumPromptRuntimeMilliseconds: 60_000,
+    maximumPromptInputBytes: 4096,
+    maximumPromptOutputBytes: 1024
+  }
 }
 const entry = {
  runtimeId: manifest.runtimeId,
@@ -19,7 +19,6 @@ import { isMissingPathError } from './path-errors'
 import { remoteHostTargetIdentityKey } from './remote-host-target-identity'

 const MAXIMUM_METADATA_BYTES = 1024 * 1024
-const PRIVATE_FILE_MODE = 0o600
 const RUNTIME_REGISTRY_PATH =
  '.goodbuddy/runtimes/registry.json'
 const OPENCODE_ROOT = '.goodbuddy/runtimes/opencode'
@@ -212,12 +211,6 @@ export class RemoteRuntimeInstallationManager {
        },
        signal
      )
-      await assertPrivateMetadata(
-        sftp,
-        RUNTIME_REGISTRY_PATH,
-        probe.uid,
-        signal
-      )
      const registry = parseRuntimeRegistryState(
        parseJsonBytes(
          await sftp.readFile(
@@ -246,12 +239,6 @@ export class RemoteRuntimeInstallationManager {
          `${OPENCODE_ROOT}/${digestDirectoryName(
            current.bundleDigest
          )}/manifest.json`
-        await assertPublicMetadata(
-          sftp,
-          manifestPath,
-          probe.uid,
-          signal
-        )
        const manifest =
          remoteRuntimeBundleManifestSchema.parse(
            parseJsonBytes(
@@ -319,44 +306,6 @@ export class RemoteRuntimeInstallationManager {

 }

-async function assertPrivateMetadata(
-  sftp: StagedSftp,
-  path: string,
-  uid: number,
-  signal: AbortSignal
-): Promise<void> {
-  const metadata = await sftp.lstat(path, signal)
-  if (
-    metadata.type !== 'file' ||
-    metadata.uid !== uid ||
-    metadata.mode !== PRIVATE_FILE_MODE ||
-    metadata.size > MAXIMUM_METADATA_BYTES
-  ) {
-    throw new Error(
-      `Remote Runtime metadata is invalid: ${path}`
-    )
-  }
-}
-
-async function assertPublicMetadata(
-  sftp: StagedSftp,
-  path: string,
-  uid: number,
-  signal: AbortSignal
-): Promise<void> {
-  const metadata = await sftp.lstat(path, signal)
-  if (
-    metadata.type !== 'file' ||
-    metadata.uid !== uid ||
-    metadata.mode !== 0o644 ||
-    metadata.size > MAXIMUM_METADATA_BYTES
-  ) {
-    throw new Error(
-      `Remote Runtime manifest metadata is invalid: ${path}`
-    )
-  }
-}
-
 function digestDirectoryName(bundleDigest: string): string {
  if (!/^sha256:[a-f0-9]{64}$/u.test(bundleDigest)) {
    throw new Error('Runtime bundle digest is invalid')
@@ -67,7 +67,6 @@ function createConnection(identity: SshPoolConnectionIdentity) {
    prepareRemotePackageBootstrap: vi.fn(),
    prepareUploadedRemotePackageBootstrap: vi.fn(),
    commitRemotePackageBootstrap: vi.fn(),
-    getRemotePackageBootstrapCommitStatus: vi.fn(),
    cleanupRemotePackageBootstrap: vi.fn(),
    runAgentLifecycleAction: vi.fn(),
    runAgentRuntimeAction: vi.fn(),
@@ -270,10 +269,6 @@ describe("SSH connection pool", () => {
      unavailable: false,
      reason: "size-mismatch",
    });
-    connection.getRemotePackageBootstrapCommitStatus.mockResolvedValue({
-      committed: false,
-      reason: "operation-unavailable",
-    });
    const pool = new SshConnectionPool(async () => connection);
    const lease = await pool.acquireRemotePackageBootstrap(createTarget());
    const candidate = {
@@ -305,12 +300,6 @@ describe("SSH connection pool", () => {
    expect(
      connection.prepareUploadedRemotePackageBootstrap,
    ).toHaveBeenCalledWith(candidate, undefined);
-    await expect(lease.commitStatus(candidate)).resolves.toMatchObject({
-      reason: "operation-unavailable",
-    });
-    expect(
-      connection.getRemotePackageBootstrapCommitStatus,
-    ).toHaveBeenCalledWith(candidate, undefined);
    expect(lease).not.toHaveProperty("exec");
    expect(lease).not.toHaveProperty("sftp");
    lease.release();
@@ -699,6 +688,10 @@ describe("authenticated ssh2 connection", () => {
      { createClient: () => client as never },
    );

+    await expect(connection.runAgentBootstrapProbe()).resolves.toMatchObject({
+      ready: true,
+      architecture: "arm64",
+    });
    await expect(connection.runAgentBootstrapProbe()).resolves.toMatchObject({
      ready: true,
      architecture: "arm64",
@@ -713,6 +706,71 @@ describe("authenticated ssh2 connection", () => {
      },
      expect.any(Function),
    );
+    expect(client.exec).toHaveBeenCalledOnce();
+    client.emit("close");
+    await expect(connection.runAgentBootstrapProbe()).rejects.toThrow(
+      "SSH 连接已关闭",
+    );
+  });
+
+  it("caches an incompatible bootstrap result on the connection", async () => {
+    const channel = Object.assign(new EventEmitter(), {
+      stderr: new EventEmitter(),
+      destroy: vi.fn(),
+    });
+    const output = [
+      "GOODBUDDY_AGENT_BOOTSTRAP_PROBE_V1",
+      "home=/home/builder",
+      "uid=1001",
+      "os=Linux",
+      "arch=riscv64",
+      "shell=/bin/bash",
+      "procfs=ready",
+      "",
+    ].join("\n");
+    const client = Object.assign(new EventEmitter(), {
+      connect: vi.fn(function connect(this: EventEmitter) {
+        this.emit("ready");
+      }),
+      end: vi.fn(),
+      destroy: vi.fn(),
+      exec: vi.fn(
+        (
+          _command: string,
+          _options: unknown,
+          callback: (error: Error | undefined, stream: typeof channel) => void,
+        ) => {
+          callback(undefined, channel);
+          setTimeout(() => {
+            channel.emit("data", output);
+            channel.emit("close", 0);
+          }, 0);
+        },
+      ),
+      sftp: vi.fn(),
+    });
+    const target = createTarget();
+    const connection = await Ssh2AuthenticatedConnection.connect(
+      target,
+      {
+        hostId: target.host.id,
+        hostRevision: target.hostRevision,
+        hostKeyGeneration: target.hostKeyGeneration,
+        authenticationIdentity: "a".repeat(64),
+      },
+      new AbortController().signal,
+      { createClient: () => client as never },
+    );
+
+    await expect(connection.runAgentBootstrapProbe()).resolves.toEqual({
+      ready: false,
+      reason: "unsupported-architecture",
+    });
+    await expect(connection.runAgentBootstrapProbe()).resolves.toEqual({
+      ready: false,
+      reason: "unsupported-architecture",
+    });
+    expect(client.exec).toHaveBeenCalledOnce();
  });

  it("cancels a running bootstrap probe and destroys its channel", async () => {
@@ -99,10 +99,6 @@ export interface AuthenticatedSshConnection {
    candidate: SshRemotePackageCandidate,
    options?: SshRemotePackageBootstrapOptions,
  ): Promise<SshRemotePackageBootstrapCommitResult>;
-  getRemotePackageBootstrapCommitStatus(
-    candidate: SshRemotePackageCandidate,
-    options?: SshRemotePackageBootstrapOptions,
-  ): Promise<SshRemotePackageBootstrapCommitResult>;
  cleanupRemotePackageBootstrap(
    operationId: string,
    options?: Pick<SshRemotePackageBootstrapOptions, "signal">,
@@ -134,7 +130,6 @@ export interface SshConnectionLease extends Omit<
  | "dispose"
  | "createRemotePackageUploadStaging"
  | "prepareUploadedRemotePackageBootstrap"
-  | "getRemotePackageBootstrapCommitStatus"
 > {
  release(): void;
 }
@@ -150,7 +145,6 @@ type InternalSshConnectionLease = SshConnectionLease &
    AuthenticatedSshConnection,
    | "createRemotePackageUploadStaging"
    | "prepareUploadedRemotePackageBootstrap"
-    | "getRemotePackageBootstrapCommitStatus"
  >;

 type ClientLike = Pick<
@@ -290,6 +284,7 @@ function waitForSharedConnection(
 export class Ssh2AuthenticatedConnection implements AuthenticatedSshConnection {
  private usable = true;
  private disposed = false;
+  private agentBootstrapProbe: AgentBootstrapProbeResult | undefined;

  private constructor(
    readonly identity: SshPoolConnectionIdentity,
@@ -298,6 +293,7 @@ export class Ssh2AuthenticatedConnection implements AuthenticatedSshConnection {
  ) {
    const disconnected = (): void => {
      this.usable = false;
+      this.agentBootstrapProbe = undefined;
    };
    this.client.on("close", disconnected);
    this.client.on("end", disconnected);
@@ -423,6 +419,11 @@ export class Ssh2AuthenticatedConnection implements AuthenticatedSshConnection {
  async runAgentBootstrapProbe(
    signal?: AbortSignal,
  ): Promise<AgentBootstrapProbeResult> {
+    this.assertUsable();
+    signal?.throwIfAborted();
+    if (this.agentBootstrapProbe !== undefined) {
+      return this.agentBootstrapProbe;
+    }
    const result = await this.runBoundedCommand(
      AGENT_BOOTSTRAP_PROBE_COMMAND,
      signal,
@@ -430,7 +431,9 @@ export class Ssh2AuthenticatedConnection implements AuthenticatedSshConnection {
    if (result.exitCode !== 0 || result.stderr.length !== 0) {
      throw new Error("Agent 启动探针执行失败");
    }
-    return parseAgentBootstrapProbeOutput(result.stdout);
+    const probe = parseAgentBootstrapProbeOutput(result.stdout);
+    this.agentBootstrapProbe = probe;
+    return probe;
  }

  probeRemotePackageBootstrap(
@@ -471,13 +474,6 @@ export class Ssh2AuthenticatedConnection implements AuthenticatedSshConnection {
    return this.remotePackageBootstrap().commit(candidate, options);
  }

-  getRemotePackageBootstrapCommitStatus(
-    candidate: SshRemotePackageCandidate,
-    options?: SshRemotePackageBootstrapOptions,
-  ): Promise<SshRemotePackageBootstrapCommitResult> {
-    return this.remotePackageBootstrap().commitStatus(candidate, options);
-  }
-
  cleanupRemotePackageBootstrap(
    operationId: string,
    options?: Pick<SshRemotePackageBootstrapOptions, "signal">,
@@ -587,6 +583,7 @@ export class Ssh2AuthenticatedConnection implements AuthenticatedSshConnection {
    }
    this.disposed = true;
    this.usable = false;
+    this.agentBootstrapProbe = undefined;
    this.client.end();
    this.client.destroy();
  }
@@ -878,11 +875,6 @@ export class SshConnectionPool {
        ),
      commit: (candidate, options) =>
        lease.commitRemotePackageBootstrap(candidate, options),
-      commitStatus: (candidate, options) =>
-        bootstrapConnection.getRemotePackageBootstrapCommitStatus(
-          candidate,
-          options,
-        ),
      cleanup: (operationId, options) =>
        lease.cleanupRemotePackageBootstrap(operationId, options),
      release: () => lease.release(),
@@ -955,13 +947,6 @@ export class SshConnectionPool {
        assertActive();
        return connection.commitRemotePackageBootstrap(candidate, options);
      },
-      getRemotePackageBootstrapCommitStatus: (candidate, options) => {
-        assertActive();
-        return connection.getRemotePackageBootstrapCommitStatus(
-          candidate,
-          options,
-        );
-      },
      cleanupRemotePackageBootstrap: (operationId, options) => {
        assertActive();
        return connection.cleanupRemotePackageBootstrap(operationId, options);
@@ -230,7 +230,6 @@ describe("fixed SSH remote package bootstrap", () => {
    await executor.prepare(candidate);
    await executor.prepareUploaded(candidate);
    await executor.commit(candidate);
-    await executor.commitStatus(candidate);
    await executor.cleanup(operationId);

    const fields = requests.map((request) => request.split("\n"));
@@ -246,7 +245,7 @@ describe("fixed SSH remote package bootstrap", () => {
      controlPlaneInstallerSha256,
      controlPlaneInstaller.toString("base64"),
    ]);
-    for (const index of [4, 5, 6]) {
+    for (const index of [4, 5]) {
      expect(fields[index]?.slice(5, 8)).toEqual(["0", "0".repeat(64), ""]);
    }
    expect(requests.map((request) => request.split("\n")[1])).toEqual([
@@ -255,7 +254,6 @@ describe("fixed SSH remote package bootstrap", () => {
      "prepare",
      "prepare-uploaded",
      "commit",
-      "commit-status",
      "cleanup",
    ]);
    expect(fields[3]?.slice(8)).toEqual(["0", ""]);
@@ -501,6 +499,12 @@ describe("fixed SSH remote package bootstrap", () => {
    expect(uploadedBlock).toContain('[ ! -x "$bootstrap/agent/node" ]');
    expect(uploadedBlock).toContain("run_prepare");
    expect(uploadedBlock).not.toMatch(/\b(?:curl|sha256sum|unzip)\b/u);
+    expect(SSH_REMOTE_PACKAGE_BOOTSTRAP_SCRIPT).toContain(
+      '--archive-sha256-verified true',
+    );
+    expect(SSH_REMOTE_PACKAGE_BOOTSTRAP_SCRIPT).toContain(
+      'actual_sha256=$(sha256sum "$archive"',
+    );
  });

  it("rejects empty installer terminal files for prepare and status", () => {
@@ -233,10 +233,6 @@ export interface SshRemotePackageBootstrapExecutor {
    candidate: SshRemotePackageCandidate,
    options?: SshRemotePackageBootstrapOptions,
  ): Promise<SshRemotePackageBootstrapCommitResult>;
-  commitStatus(
-    candidate: SshRemotePackageCandidate,
-    options?: SshRemotePackageBootstrapOptions,
-  ): Promise<SshRemotePackageBootstrapCommitResult>;
  cleanup(
    operationId: string,
    options?: Pick<SshRemotePackageBootstrapOptions, "signal">,
@@ -572,6 +568,7 @@ run_prepare() {
  "$bootstrap/agent/node" "$bootstrap/package-installer.mjs" \
    prepare --operation-root "$operation_root" --archive "$archive" \
    --expected-sha256 "$expected_sha256" \
+    --archive-sha256-verified true \
    >"$installer_output" 2>/dev/null || true
  installer_output_size=$(wc -c < "$installer_output" 2>/dev/null) ||
    stop failed installer-failed
@@ -1611,9 +1608,6 @@ export function createSshRemotePackageBootstrapExecutor(
      }
      throw new Error("Agent 远程安装提交返回了无效结果");
    },
-    commitStatus(candidate, options = {}) {
-      return readCommitStatus(candidate, options);
-    },
    async cleanup(operationId, options = {}) {
      const verifiedOperationId = validateOperationId(operationId);
      const result = await runBootstrapCommand(
@@ -26,7 +26,7 @@ import {
  type AgentReleaseKeyRegistry
 } from '../agent-installation-contracts'
 import {
-  assertDetachedRemoteRuntimeBundleDigest,
+  digestRemoteRuntimeBundleIdentity,
  digestRemoteRuntimeBundleManifest,
  remoteRuntimeBundleManifestSchema,
  remoteRuntimeLockSchema,
@@ -75,6 +75,68 @@ export type LoadRegisteredRuntimeBundleOptions =
 export async function verifyRuntimeBundle(
  bundleDirectoryInput: string,
  options: VerifyRuntimeBundleOptions
+): Promise<VerifiedRuntimeBundle> {
+  const verified = await verifyPublishedRuntimeBundle(
+    bundleDirectoryInput,
+    options
+  )
+  const { bundleDirectory, manifest } = verified
+  const inventory = await inventoryBundleFiles(
+    bundleDirectory,
+    options.uid
+  )
+  const declaredPaths = new Set(
+    manifest.files.map((file) => file.path)
+  )
+  for (const file of manifest.files) {
+    const filePath = join(
+      bundleDirectory,
+      ...file.path.split('/')
+    )
+    const stat = inventory.get(file.path)
+    if (stat === undefined) {
+      throw new Error(`Runtime payload is missing: ${file.path}`)
+    }
+    if (stat.size !== file.size) {
+      throw new Error(`Runtime payload size mismatch: ${file.path}`)
+    }
+    if ((await sha256File(filePath)) !== file.sha256) {
+      throw new Error(`Runtime payload hash mismatch: ${file.path}`)
+    }
+    if (
+      shouldEnforceMode(options) &&
+      modeString(stat.mode) !== file.mode
+    ) {
+      throw new Error(`Runtime payload mode mismatch: ${file.path}`)
+    }
+  }
+
+  const actualPaths = new Set(inventory.keys())
+  const expectedPaths = new Set([
+    ...declaredPaths,
+    MANIFEST_FILE_NAME,
+    SIGNATURE_FILE_NAME
+  ])
+  if (
+    actualPaths.size !== expectedPaths.size ||
+    [...actualPaths].some((path) => !expectedPaths.has(path))
+  ) {
+    throw new Error(
+      'Runtime bundle contains undeclared or missing files'
+    )
+  }
+
+  return verified
+}
+
+/**
+ * Authenticates a package-installer-published Runtime from signed metadata and
+ * bounded entrypoint metadata. The installer already hashed every payload
+ * file while extracting it.
+ */
+export async function verifyPublishedRuntimeBundle(
+  bundleDirectoryInput: string,
+  options: VerifyRuntimeBundleOptions
 ): Promise<VerifiedRuntimeBundle> {
  const bundleDirectory = assertAbsoluteManagedPath(
    resolve(bundleDirectoryInput)
@@ -125,55 +187,35 @@ export async function verifyRuntimeBundle(
    )
  }

-  const inventory = await inventoryBundleFiles(
-    bundleDirectory,
-    options.uid
+  const executableRecord = manifest.files.find(
+    (file) => file.path === manifest.entrypoint.path
  )
-  const declaredPaths = new Set(
-    manifest.files.map((file) => file.path)
-  )
-  for (const file of manifest.files) {
-    const filePath = join(
-      bundleDirectory,
-      ...file.path.split('/')
-    )
-    const stat = inventory.get(file.path)
-    if (stat === undefined) {
-      throw new Error(`Runtime payload is missing: ${file.path}`)
-    }
-    if (stat.size !== file.size) {
-      throw new Error(`Runtime payload size mismatch: ${file.path}`)
-    }
-    if ((await sha256File(filePath)) !== file.sha256) {
-      throw new Error(`Runtime payload hash mismatch: ${file.path}`)
-    }
-    if (
-      shouldEnforceMode(options) &&
-      modeString(stat.mode) !== file.mode
-    ) {
-      throw new Error(`Runtime payload mode mismatch: ${file.path}`)
-    }
-  }
-
-  const actualPaths = new Set(inventory.keys())
-  const expectedPaths = new Set([
-    ...declaredPaths,
-    MANIFEST_FILE_NAME,
-    SIGNATURE_FILE_NAME
-  ])
-  if (
-    actualPaths.size !== expectedPaths.size ||
-    [...actualPaths].some((path) => !expectedPaths.has(path))
-  ) {
+  if (executableRecord === undefined) {
    throw new Error(
-      'Runtime bundle contains undeclared or missing files'
+      'Published Runtime entrypoint is not declared'
    )
  }
-
  const executablePath = join(
    bundleDirectory,
    ...manifest.entrypoint.path.split('/')
  )
+  const executableStat = await lstat(executablePath)
+  assertOwnedRegularFile(
+    executableStat,
+    'Runtime executable',
+    options.uid
+  )
+  if (
+    executableStat.size !== executableRecord.size ||
+    (
+      shouldEnforceMode(options) &&
+      modeString(executableStat.mode) !== executableRecord.mode
+    )
+  ) {
+    throw new Error(
+      'Published Runtime entrypoint metadata changed'
+    )
+  }
  await assertElfArchitecture(
    executablePath,
    options.architecture,
@@ -197,57 +239,14 @@ export async function loadRegisteredRuntimeBundle(
  bundleDirectoryInput: string,
  options: LoadRegisteredRuntimeBundleOptions
 ): Promise<VerifiedRuntimeBundle> {
-  const bundleDirectory = assertAbsoluteManagedPath(
-    resolve(bundleDirectoryInput)
-  )
  const registered = runtimeRegistryEntrySchema.parse(
    options.registered
  )
-  const rootStat = await lstat(bundleDirectory)
-  assertOwnedDirectory(
-    rootStat,
-    'Runtime bundle directory',
-    options.uid
-  )
-  if (
-    shouldEnforceMode(options) &&
-    modeString(rootStat.mode) !== '0700'
-  ) {
-    throw new Error(
-      'Runtime bundle directory permissions must be 0700'
-    )
-  }
-  if (
-    basename(bundleDirectory) !==
-    registered.bundleDigest.slice('sha256:'.length)
-  ) {
-    throw new Error(
-      'Registered Runtime digest does not match its managed directory'
-    )
-  }
-
-  const manifestBytes = await readMetadataFile(
-    join(bundleDirectory, MANIFEST_FILE_NAME),
-    'Runtime manifest',
+  const verified = await verifyPublishedRuntimeBundle(
+    bundleDirectoryInput,
    options
  )
-  const signatureBytes = await readSignature(
-    join(bundleDirectory, SIGNATURE_FILE_NAME),
-    options
-  )
-  const manifest = await verifyRuntimeManifestSignature(
-    manifestBytes,
-    signatureBytes,
-    options.releaseKeyRegistry,
-    options.verificationEnvironment ?? 'production'
-  )
-  assertRuntimeManifestMatchesLock(
-    manifest,
-    remoteRuntimeLockSchema.parse(options.runtimeLock),
-    options.architecture
-  )
-  const manifestDigest =
-    await digestRemoteRuntimeBundleManifest(manifest)
+  const { manifest, manifestDigest } = verified
  if (
    manifest.runtimeId !== registered.runtimeId ||
    manifest.runtimeVersion !== registered.runtimeVersion ||
@@ -266,41 +265,7 @@ export async function loadRegisteredRuntimeBundle(
    )
  }

-  const executableRecord = manifest.files.find(
-    (file) => file.path === manifest.entrypoint.path
-  )
-  if (executableRecord === undefined) {
-    throw new Error(
-      'Registered Runtime entrypoint is not declared'
-    )
-  }
-  const executablePath = join(
-    bundleDirectory,
-    ...manifest.entrypoint.path.split('/')
-  )
-  const executableStat = await lstat(executablePath)
-  assertOwnedRegularFile(
-    executableStat,
-    'Runtime executable',
-    options.uid
-  )
-  if (
-    executableStat.size !== executableRecord.size ||
-    (
-      shouldEnforceMode(options) &&
-      modeString(executableStat.mode) !== executableRecord.mode
-    )
-  ) {
-    throw new Error(
-      'Registered Runtime entrypoint metadata changed'
-    )
-  }
-  return {
-    bundleDirectory,
-    executablePath,
-    manifest,
-    manifestDigest
-  }
+  return verified
 }

 export function canonicalRuntimeManifestBytes(
@@ -362,16 +327,12 @@ export async function verifyRuntimeManifestSignature(
  ) {
    throw new Error('Runtime manifest signature verification failed')
  }
-  await assertDetachedRemoteRuntimeBundleDigest({
-    manifest,
-    detachedSignature: {
-      manifestDigest:
-        await digestRemoteRuntimeBundleManifest(manifest),
-      algorithm: 'ed25519',
-      keyId: manifest.signingKeyId,
-      signatureBase64: signatureBytes.toString('base64')
-    }
-  })
+  if (
+    await digestRemoteRuntimeBundleIdentity(manifest) !==
+    manifest.bundleDigest
+  ) {
+    throw new Error('Runtime bundle identity digest does not match')
+  }
  return manifest
 }