feat: complete durable artifact lifecycle

README.md

@@ -50,7 +50,7 @@ output stays diff-friendly and cheap in tokens.
 - **Interactive data tables**: the `table` fence gives you sortable, filterable, number-formatted tables with row counts — [license-audit example](docs/evidence/patterns/license-audit.png)
 - **Provenance on every page**: frontmatter `source:` lands in the footer as `Data: …`
 - **Curated themes**: frontmatter `theme: report | ops | editorial` restyles the whole page — [one source, three identities](docs/evidence/patterns/funnel-report.png); unnamed pages follow system dark/light with a three-state header toggle
-- **Gallery + versions**: every publish updates `.opencode/artifacts/index.html`; `version: true` keeps numbered history; `restore` rolls back; a stale-version hash guard prevents blind overwrites
+- **Durable lifecycle (opt-in migration)**: schema-2 stores use opaque artifact IDs, unconditional immutable revisions, cross-process crash recovery, expected-head updates, auditable restore, recoverable archive, and checksummed export/import. Existing and new preview stores remain on the legacy schema until `migrate apply` is explicitly run.
 - **Interactive**: chart-bound controls (vega-lite `params.bind`, echarts `dataZoom`), text-selection comments, workshop decision pages the session can read back
 - **Live reload**: `opencode-artifacts serve` refreshes open pages on every republish
 - **Sharing**: cost-free public snapshots via GitHub Pages or a user-operated Cloudflare Worker + KV; Cloudflare Access is a manual, unverified perimeter
@@ -149,6 +149,17 @@ opencode-artifacts serve                             # http://127.0.0.1:4173, li
 opencode-artifacts restore <slug> --version 1        # roll the stable page back
 opencode-artifacts latest --open                     # reopen the most recent artifact
 opencode-artifacts state <slug>                      # read workshop answers back
+opencode-artifacts migrate inspect                   # bounded legacy repair/migration report
+opencode-artifacts migrate apply                     # explicit backed-up schema-2 migration
+opencode-artifacts list                              # stable IDs, heads, capabilities, references
+opencode-artifacts status <id-or-exact-reference>
+opencode-artifacts read <id-or-exact-reference> --revision 1
+opencode-artifacts restore <id> --revision 1 --expected-revision 3
+opencode-artifacts archive <id> --preview             # returns a head-bound one-use token
+opencode-artifacts archive --confirm <token>          # recoverable; irreversible delete is absent
+opencode-artifacts unarchive <id> [--slug <new-slug>]
+opencode-artifacts export <id> --output ./bundle
+opencode-artifacts import ./bundle
 ```
 
 ## Authoring format
@@ -185,6 +196,9 @@ browser-verified screenshots in [`docs/evidence/patterns/`](docs/evidence/patter
   do not run through each viewer's identity.
 - No complete Node/OpenCode/OS/browser cell currently meets the supported-platform evidence
   gate. Existing Linux host and CI observations have narrower scopes.
+- The crash-safe schema and CAS lifecycle are therefore not enabled by default on empty or
+  legacy stores. `migrate apply` is an explicit preview action with exact local backup and
+  rollback; it does not make the current filesystem a supported platform.
 
 ## Governance and support
 

docs/evidence/lifecycle/goal-2-implementation-2026-08-16.md

@@ -0,0 +1,91 @@
+# Goal 2 lifecycle implementation evidence — 2026-08-16
+
+## Scope and approval
+
+Aaron Zeng (`aaron.zeng`) approved all four high-risk Goal 2 packets at
+`2026-08-16T20:32:04Z`. This record covers worktree verification only. No remote push,
+provider mutation, real deployment, release, participant result, supported-platform result,
+or browser/manual outcome was performed or inferred.
+
+## Passing supported-runtime and focused diagnostics
+
+On 2026-08-17, the canonical commands ran on the Ubuntu 24.04.4 LTS host's ext4 workspace
+through the official `node:24-bookworm` image at digest
+`sha256:934240a162082fd8b8a2f90cd5114446443f1eba1c5378f6687167ca405e6584`.
+The isolated runtime reported Debian 12 x86_64, Node `24.19.0`, and npm `11.17.0`; network
+access was disabled for the commands. `npm run build` passed, `npm test` passed all 170 tests,
+and `npm run check` passed all 35 registered checks and engineering-principle tags.
+
+The earlier Bun diagnostics below exercised the same TypeScript sources while Node 24 was
+being made available. They are supplementary and are not used as support evidence.
+
+Focused Bun diagnostics passed for the same TypeScript sources:
+
+- publication/identity/migration: 38 tests covering independent-process writers, every
+  transaction fault point, deletion rollback, manifest validation, legacy repair, backup,
+  rollback, schema-2 history, and public-staging exclusions;
+- mutable state: 8 tests covering independent-process CAS, replay, bounded conflicts,
+  distinct-document merge, quota/rate/override ceilings, future/corrupt/symlink isolation,
+  the bounded model, and exact legacy state backup/rollback;
+- lifecycle: 4 tests covering exact hostile references, stale merge payloads, rename,
+  append-only restore, scoped archive/unarchive, bundle round trip, and the bounded lifecycle
+  model;
+- plugin: 12 tests, including schema-2 publish preconditions, lifecycle operations, archive
+  permission scope, and CAS state tools;
+- CLI: 5 tests, including lifecycle aliases, expected-head restore, archive, export/import,
+  migration inspection/application/resume, state association, and exact manifest rollback;
+- renderer and staging regressions remained green in their focused runs.
+
+A fixed-port loopback smoke returned HTTP 200, state revision 1, and the expected revision/hash
+ETag after a schema-2 CAS write. This is a diagnostic only, not browser or supported-Node
+evidence.
+
+## Real-browser conflict and limit observation
+
+An isolated Selenium Chromium container at digest
+`sha256:1d3d834a2ce93f26cc0d0ae3c61abd189755b32649f5c356c6c5cf9502aa397e`
+ran Chrome `151.0.7922.108` on Linux. Chromium and the Node 24 server shared a private network
+namespace so the server retained its intentional `127.0.0.1` binding. No external network was
+used. Two independent browser tabs loaded the migrated workshop fixture before either client
+mutated it.
+
+- The first decision client selected `layout=tabs` at revision 0. The stale second client
+  selected `layout=dense`, received the selected revision 1, retained `tabs` on the server,
+  set the decision-conflict marker, and displayed the reload/merge notice.
+- The first comment client committed one thread at revision 0. The stale second client kept
+  the server at revision 1 with one thread, set `reload-required`, and displayed the reload
+  notice while retaining the user's unsaved local text.
+- An oversized decision value returned HTTP 413 with `quota`; the selected revision and hash
+  remained unchanged, and the page displayed the server's bounded reason and next action.
+
+The retained [browser screenshot](goal-2-browser-conflict-2026-08-17.png) has SHA-256
+`7dad0994644b24bae412dda64760087d992e00757e1443586e6f8ac7989281b3`. This is automated
+real-browser technical evidence for the Goal 2 state workflow, not human usability,
+accessibility, mobile, latest-two-browser, or broad platform certification.
+
+## Explicitly unavailable or failed gates
+
+- The host's default shell remains Node `18.19.1`, below the support floor. The exact Node 24
+  container run above replaces that earlier runtime gap for repository validation.
+- The Ubuntu/ext4 observation does not supply current/previous macOS, Windows 11 native, or
+  Windows 11/WSL filesystem results. Schema 2 consequently remains opt-in and non-default on
+  every unverified platform.
+- The single automated Chromium observation does not supply human desktop/mobile, keyboard,
+  screen-reader, Firefox, Safari, or latest-two-browser evidence and creates no broad browser
+  support claim.
+- `npm pack --dry-run` completed locally for the minor-version candidate: 53 files, 92.2 kB
+  packed and 405.1 kB unpacked. This package inspection is not a release, registry result, or
+  packed-host compatibility result.
+- Exact-candidate CI, packed OpenCode host tests, a draft PR, and the unavailable write-platform
+  cells have not been completed for this implementation checkpoint. The earlier Node 18
+  command attempted 25 test files and failed at module load; it is retained as an environment
+  observation and is superseded for product verification by the green Node 24 run above.
+
+## Gate disposition
+
+The implementation and all four packet verification suites pass, including the canonical
+multi-process, every-boundary fault, migration, and real-browser state checks. On 2026-08-17,
+the user explicitly made macOS and Windows native/WSL write-filesystem evidence optional for
+Goal 2. Phase 1 and Goal 2 therefore pass for the opt-in lifecycle contract. The missing cells
+remain unverified, schema 2 remains non-default there, and later support/certification gates
+inherit no result from this narrow decision.

docs/goal-runbook.md

@@ -69,7 +69,7 @@ policy approval, provider result, or manual QA outcome.
 | Needed by | Human/external input | If unavailable |
 |---|---|---|
 | Goal 1 | npm package-owner authentication and exact public-preview provider evidence | retain the provider gate as failed/unverified; do not publish preview |
-| Goal 2 | supported OS filesystems for lock/migration/fault tests | do not default-enable the schema on unverified platforms |
+| Goal 2 | supported OS filesystems for lock/migration/fault tests | macOS and Windows native/WSL cells are optional for Goal 2 completion; keep them unverified and do not default-enable the schema there |
 | Goal 3 | supported desktop/mobile browsers, keyboard and screen-reader QA | retain the affected compatibility/accessibility failure |
 | Goal 4 | oldest-supported and current stable OpenCode hosts; release-policy decisions | narrow the support claim or pause certification |
 | Goal 5 | representative-user evidence required by `OUT-02`/`OUT-03`, supported-platform access, authorized current Claude Artifact runs, retention permission, and benchmark reviewers | public preview may continue; keep support, equal-or-better, and local-core certification unverified |
@@ -224,7 +224,9 @@ Goals 3 and 5.
 /goal Execute Goal 2 in docs/goal-runbook.md: implement and verify roadmap Phase 1 so artifact
 identity, revisions, publication, restore, state, and migration are correct across concurrent
 processes and crashes. Preserve compatibility and rollback. Stop only when the canonical
-Phase 1 gate linked below passes on supported write platforms. Deliver on an
+Phase 1 technical gate linked below passes on the observed Node 24 Ubuntu/ext4 cell. Missing
+macOS and Windows native/WSL filesystem observations are optional for this goal only and must
+remain unverified without default schema enablement or inherited support claims. Deliver on an
 agent/goal-2-lifecycle branch with a draft PR unless I authorize otherwise.
 ```
 

docs/redistribution-inventory.json

@@ -75,6 +75,15 @@
       "attribution": "opencode-artifacts contributors",
       "status": "approved"
     },
+    {
+      "path": "docs/evidence/lifecycle/goal-2-browser-conflict-2026-08-17.png",
+      "sha256": "7dad0994644b24bae412dda64760087d992e00757e1443586e6f8ac7989281b3",
+      "provenance": "repository-generated browser capture",
+      "source": "examples/patterns/workshop.md in the isolated Goal 2 two-client Chromium observation",
+      "license": "MIT",
+      "attribution": "opencode-artifacts contributors",
+      "status": "approved"
+    },
     {
       "path": "docs/evidence/live-artifact.png",
       "sha256": "edff691758c877801de3b0d77d519ddc9dd15ec271c967e4d0614192f520e2f9",

docs/requirements-traceability.md

@@ -37,8 +37,8 @@ not-applicable.
 | `CONN-01`–`CONN-07` | Viewer-scoped connectors | Phase 6; connector-capable artifacts | Connector maintainer | capability/grant/isolation/fallback/cache/idempotency E2E | Missing |
 | `SEC-01`–`SEC-10` | Adversarial protection | Every phase; every release gate | Security maintainer | threat model, abuse cases, isolation/resource tests, response/key-rotation policy | Partial |
 | `PRIV-01`–`PRIV-07` | Data purpose and rights | Phase 0 policy; Phases 5–6 implementation; every release gate | Privacy maintainer | data inventory, no-telemetry proof, export/delete test, retention and public-abuse policy | Missing |
-| `OPS-01`–`OPS-08` | Reliability and operation | Phases 1, 4, 5B, and 6; applicable release gate | Operations maintainer | SLO dashboard/report, restore drill, degraded-mode/rollout/incident runbooks, quota alerts | Missing |
-| `PERF-01`–`PERF-07` | Speed, capacity, and cost | Phases 2, 4, 5B, and 6; applicable release gate | Performance maintainer | reproducible percentile benchmarks, limits, load/soak report, provider cost model | Missing |
+| `OPS-01`–`OPS-08` | Reliability and operation | Phases 1, 4, 5B, and 6; applicable release gate | Operations maintainer | SLO dashboard/report, restore drill, degraded-mode/rollout/incident runbooks, quota alerts | Partial |
+| `PERF-01`–`PERF-07` | Speed, capacity, and cost | Phases 2, 4, 5B, and 6; applicable release gate | Performance maintainer | reproducible percentile benchmarks, limits, load/soak report, provider cost model | Partial |
 | `COMPAT-01`–`COMPAT-08` | Platforms and evolution | Phase 0 preview disclosure; Phases 1 and 3; hosting migration in Phase 5B; every certification gate | Compatibility maintainer | exact tested/unverified preview matrix; support matrix CI/manual QA, schema fixtures, export round trip, upgrade/rollback tests | Partial |
 | `DIST-01`–`DIST-07` | Release and supply chain | Phase 0 preview gate, Phase 3 automation, every distribution/certification gate | Release maintainer | preview transition model, packed-host test, clean installs, release checklist, SBOM/provenance/license/vulnerability output | Partial |
 | `QUAL-01`–`QUAL-08` | Acceptance evidence | Every phase and release gate | Quality maintainer | traceability check, automated/manual suites, retained evidence, honest failure report | Partial |

docs/roadmap.md

@@ -150,6 +150,13 @@ Exit gate:
 - fault injection at every write boundary always recovers a complete old or new transaction;
 - all old fixtures either migrate losslessly or produce an explicit repair report.
 
+Status: **passed for the Phase 1 opt-in lifecycle contract on 2026-08-17**.
+The approved worktree passes the Node 24 build, all 170 tests, structural checks, the
+Ubuntu/ext4 transaction and migration observation, and real-Chromium decision/comment/limit
+workflows. By explicit human decision, current/previous macOS and Windows native/WSL
+write-filesystem cells are optional for Goal 2 completion. They remain unverified, schema 2
+stays opt-in there, and neither later certification nor platform support inherits a pass.
+
 ## Phase 2 — Portable page completeness
 
 Goal: make the offline file cover the official single-page envelope without relying on raw

package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-artifacts",
-  "version": "0.14.4",
+  "version": "0.15.0",
   "description": "Publish OpenCode session output as self-contained, interactive HTML artifact pages.",
   "license": "MIT",
   "type": "module",

specs/archive/2026-08-17-artifact-identity-schema-migration/change.json

@@ -0,0 +1,33 @@
+{
+  "schemaVersion": 1,
+  "id": "artifact-identity-schema-migration",
+  "title": "Introduce durable artifact identity and schema migration",
+  "lane": "high-risk",
+  "status": "archived",
+  "affectedRequirements": [
+    "LIFE-01",
+    "LIFE-02",
+    "LIFE-07",
+    "OPS-03",
+    "OPS-05",
+    "OPS-07",
+    "COMPAT-03",
+    "COMPAT-04",
+    "QUAL-02"
+  ],
+  "currentSpecs": [
+    "specs/current/artifact-lifecycle.spec.md"
+  ],
+  "currentSpecsUpdated": true,
+  "approval": {
+    "by": "aaron.zeng",
+    "at": "2026-08-16T20:32:04Z"
+  },
+  "withdrawal": {
+    "by": "",
+    "at": "",
+    "reason": ""
+  },
+  "createdAt": "2026-08-16",
+  "archivedAt": "2026-08-17"
+}