- **Minor:** No new findings in this scoped merge review.
6
7
The composition preserves both guarantees. `internal/release/adopt.go:1899` checks the canonical manifest before staging and passes that same manifest and raw bytes into `stageFrom`. At `:1833–1847`, mismatched copies are refused when referenced or when references are unknown. Unreferenced copies are downloaded and verified against the checked manifest. The no-digest path preserves main’s staging behavior.
8
9
Both `WithDigestRatchet` and `WithPinSource` remain. The `verified` map’s change to artifact SHA values is correct: `adopt.go:1815` prevents a digest-bound host from trusting verification against another manifest while preserving main’s unbound reuse behavior.
10
11
Verdicts on the five concerns:
12
13
1. **Unreadable manifest with a digest — acceptable.** `internal/release/adopt.go:1899` fails closed before downloading or restaging. Adoption can stall during a bucket outage, but silently using an unchecked staged copy would weaken the required guarantee. No fix needed.
14
15
2. **“Version name reused” refusal — acceptable.** `internal/release/adopt.go:1847` uses `ErrVersionReused` specifically after the canonical manifest passes its digest check and the referenced staged binary differs. A canonical-manifest mismatch still produces `ErrManifestDigest`. The distinction is appropriate; no fix needed.
16
17
3. **Overwriting a readable sibling — acceptable.** `internal/release/adopt.go:1912` synchronizes it to the checked raw bytes after the binary matches. Readability alone cannot establish that a sibling contains the signed manifest, particularly after an older lossy re-marshal. Different signed manifests sharing one binary can replace this shared metadata, as reported; that does not defeat either reviewed guarantee. No merge fix needed.
18
19
4. **Edge helper rename — correct.** `internal/edge/staticdigest_test.go:51` now defines `getBody`, avoiding the unrelated `body` at `internal/edge/genproxy_test.go:161`. The callers were updated consistently; no behavior change.
20
21
5. **Held materialization remains digest-free — outside this merge’s pointer composition.** `internal/release/materializeheld.go:168` stages a move-pinned version without resolving a signed channel pointer. Its unchanged call through `ensureStaged` refuses mismatched staged copies because references are unknown. It does not establish digest-bound authorization for fresh held downloads; that remains separate work, not a regression introduced by this resolution.
22
23
The report’s control-flow table matches the implementation. The new tests cover checked-manifest reuse, referenced refusal, unreferenced restaging, cross-manifest verification caching, and exact sibling bytes.
24
25
Scoped `git diff --check` passes. Tests/builds were not rerun because this review is read-only; reported execution results remain independently unverified. `origin/main` has advanced to `f36718c5`, but its intervening changes do not touch the scoped files. No files changed.
amadan