fix: let a full provision run compose with a published extract

[jeremi]

Problem

publish-extract is the documented way to bind a later checkpoint. It appends
the new extract under a fresh immutable filename and preserves the old file,
and it rewrites runtime.yaml while leaving runtime.rollback-<old_id>.yaml
behind. Both leftovers are deliberate: a rollback needs them.

A later full provision run then failed. _check_install_tree compares the
staged tree against the destination, and the runtime side was already given
_preserve_extract_rollback, but the extracts side was called with no
preserve predicate at all. The preserved .sqlite counted as an unexpected
file and raised existing output mismatch, so the escape hatch and the normal
provision path did not compose.

Fix

_preserve_superseded_extracts(active) looks past a superseded published
extract and nothing else. A file qualifies only when it is:

• top level (no / in the relative path),
• not the extract this run staged,
• named for a timestamped publication (<prefix>-<YYYYmmddTHHMMSS[micros]>Z.sqlite),
• a file rather than a directory,
• mode 0o444.

The staged extract is deliberately excluded, so it stays verified against what
this run wrote. ROLLBACK_RUNTIME and the new PUBLISHED_EXTRACT now share one
PUBLICATION fragment, since publish-extract names the extract and the runtime
it supersedes after the same publication. ROLLBACK_RUNTIME matches exactly what
it matched before.

_stage_evidence now returns the extract name it bound (or None for a cell
that holds no extract) so the caller can build the predicate.

Tests

Written first, red at the real call site before the fix:

• test_provision_composes_with_a_published_extract — the regression. Lays out
  a genuine post-publish-extract tree (both extracts at 0o444, both runtime
  files) and asserts provision succeeds, the superseded extract survives
  byte-identical at 0o444, and the extract directory ends at 0o555.
• test_provision_still_refuses_an_unpublished_extract_file — drops a
  sro-poverty-restored.sqlite into the same tree and asserts
  existing output mismatch still raises.
• test_only_a_superseded_published_extract_is_preserved — the predicate
  itself: false for the active extract, a foreign prefix, a nested path, a
  directory, mode 0o644, and a .bak suffix.

Mutation-checked: widening PUBLISHED_EXTRACT to ^.*\.sqlite$ fails 2 of
them, so the narrowness is actually pinned.

Verification

• uv run python -m unittest scripts.test_provision_hosted_runtime — 43 tests, OK
• just test — 20 + 28 + 251 Python tests OK, 61 vitest tests passed
• just lint — ruff clean, all gate scripts pass, portal 423 files / 0 errors,
  home 388 files / 0 errors

Note

scripts/provision-hosted-runtime.py ships inside the provisioner image, so the
live fleet does not pick this up from a merge alone. It needs a
release-candidate build and a digest re-pin.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 000d399d35

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Limit preserved extracts to the provisioned authority

When provisioning one direct cell, this global pattern also preserves timestamped extracts belonging to either of the other direct authorities; for example, sro-evidence silently filters a top-level, mode-0444 cra-birth-20260812T090000Z.sqlite out of both inventory checks. Such a file cannot be a superseded publication from SRO's publish-extract, so a misplaced or foreign artifact is accepted instead of producing existing output mismatch. Scope the predicate to the active extract's authority prefix (or pass the current cell explicitly).

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 45a92cd463

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate preserved extracts before excluding them

When a same-authority rollback extract is corrupted or replaced while retaining a timestamp-shaped filename and mode 0444, the newly scoped predicate still excludes it from both inventory comparisons based solely on its name and mode. A later full provision therefore reports success while preserving an unusable or untrusted database that the retained rollback runtime may reference; validate each candidate's metadata/schema/integrity, or correlate it with verified rollback state, before treating it as a superseded publication.

Useful? React with 👍 / 👎.