Enforce an executable release freeze barrier

.github/scripts/candidate-archive-store.mjs

@@ -874,6 +874,7 @@ function publishStoreEntry(storeRoot, inputRoot, record) {
       removeOwnedTemporary(temporary, paths.parent, path.basename(paths.entry));
       return { admitted: false, ...concurrent };
     }
+    const prepared = lstatSync(temporary, { bigint: true });
     try {
       renameSync(temporary, paths.entry);
     } catch (error) {
@@ -884,6 +885,15 @@ function publishStoreEntry(storeRoot, inputRoot, record) {
       removeOwnedTemporary(temporary, paths.parent, path.basename(paths.entry));
       return { admitted: false, ...concurrent };
     }
+    const published = lstatSync(paths.entry, { bigint: true });
+    if (
+      !published.isDirectory()
+      || published.isSymbolicLink()
+      || published.dev !== prepared.dev
+      || published.ino !== prepared.ino
+    ) {
+      fail("candidate archive store entry was not published by atomic directory rename");
+    }
     return { admitted: true, ...verifyStoreEntry(storeRoot, expected) };
   } catch (error) {
     if (existsSync(temporary)) {

.github/scripts/candidate-archive-store.test.mjs

@@ -17,7 +17,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import test from "node:test";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
   admitCandidateArchive,
@@ -291,6 +291,45 @@ test("admission and a later hit materialize the complete exact payload as fresh
   }
 });
 
+test("admission rejects sequential publication beneath the final store key", async () => {
+  const fixture = createFixture();
+  try {
+    const source = readFileSync(SCRIPT, "utf8");
+    const atomicPublication = "      renameSync(temporary, paths.entry);";
+    assert.equal(
+      source.split(atomicPublication).length - 1,
+      1,
+      "atomic store publication must have one mutation target",
+    );
+    const sequentialPublication = [
+      "      mkdirSync(paths.entry, { mode: 0o700 });",
+      "      renameSync(temporaryPayload, paths.payload);",
+      "      renameSync(path.join(temporary, RECORD_FILE), paths.recordFile);",
+      "      rmSync(temporary, { recursive: true });",
+    ].join("\n");
+    const mutantFile = path.join(fixture.root, "candidate-archive-store-mutant.mjs");
+    writeFileSync(
+      mutantFile,
+      source.replace(atomicPublication, sequentialPublication),
+      { flag: "wx" },
+    );
+    const mutant = await import(pathToFileURL(mutantFile).href);
+    assert.throws(
+      () => mutant.admitCandidateArchive({
+        inputRoot: fixture.inputRoot,
+        outputDir: outputDir(fixture),
+        outputRoot: fixture.outputRoot,
+        record: fixture.record,
+        storeRoot: fixture.storeRoot,
+      }),
+      /not published by atomic directory rename/u,
+    );
+    assert.equal(statExists(outputDir(fixture)), false);
+  } finally {
+    cleanup(fixture);
+  }
+});
+
 test("the public checksum companion pair is mandatory", () => {
   const fixture = createFixture();
   try {

.github/scripts/check-calibration-release-lineage.py

@@ -24,12 +24,21 @@ def main() -> int:
     )
     parser.add_argument("--repo", required=True, type=Path)
     parser.add_argument("--expected-sha", required=True)
+    parser.add_argument(
+        "--allow-promotion-commit",
+        action="store_true",
+        help=(
+            "Permit one tree-preserving main promotion commit whose release "
+            "parent is the direct constant-freeze child."
+        ),
+    )
     arguments = parser.parse_args()
 
     repository_root = arguments.repo.resolve(strict=True)
     result = verify_release_head_calibration_lineage(
         repository_root,
         arguments.expected_sha,
+        allow_promotion_commit=arguments.allow_promotion_commit,
     )
     print(json.dumps({"status": "passed", **result}, sort_keys=True))
     return 0