# Package lifecycle evidence replay

The lifecycle harness runs two independently cached native clients against one
isolated local authority. It publishes A1, updates to B2, stops its fixture CDN,
rolls back to A1 content at generation A3, rejoins a fresh native client, then
terminates and restarts the server against its fenced checkpoint without genesis.

Entry point: `services/pajama-edge/test/native_catalog_v2_two_client_e2e.mjs`.
It requires the repository checkout, installed local Edge dependencies, and a
trusted loopback certificate. It never disables TLS verification or deploys Edge.

Default reproduction builds its own task-specific binaries and fixtures:

```powershell
node services/pajama-edge/test/native_catalog_v2_two_client_e2e.mjs `
  --cert <trusted-loopback.pem> --key <matching-private-key.pem> `
  --evidence-dir <fresh-absolute-evidence-directory> `
  --offline-rejoin-one-client --server-crash-recovery
```

To reuse compatible binaries, additionally supply both:

```text
--bins-dir <directory-containing-pajama-server-and-pajama-client>
--fixture-test-bin <compiled-shard_agent_e2e-test-executable>
```

The client must include `catalog-v2-process-e2e,retained-presentation-wire-v1`.
The fixture executable must contain the exact marker migration, terrain
one-shot, and playable Package exporter tests. Those tests still execute;
only Cargo compilation is skipped. The exporter generates fresh immutable
fixtures bound to the new local HTTPS origin. Do not reuse old fixture URLs.

After the full lifecycle run passes, generate its labeled five-stage reel:

```powershell
node scripts/authoring/make-lifecycle-reel.mjs `
  --evidence-dir <passed-lifecycle-evidence-directory> --ffmpeg <ffmpeg-executable>
```

The builder checks the strict success receipt and every source PNG's SHA-256,
then creates a fresh `whitepaper` directory. It refuses to overwrite an existing
directory and fully decodes the finished MP4 before writing public proof metadata.

## Recorded result

The run `target/whitepaper-lifecycle-evidence-20260921-02` passed the strict gate:

- Both clients published the exact A1, B2, A3 catalog cuts with zero placeholders.
- Offline rollback and fresh-process rejoin succeeded after the CDN stopped.
- A fresh server recovered the exact active/rollback catalogs, with epoch 1 → 2.
- Terrain remained at two edits; ABI2 marker/terrain states remained 5/2 after
  recovery, proving those one-shot actions did not replay.
- V6 checkpoint root, content recovery, world, execution state and Package skill
  state were verified by immutable SHA-256 references and schema checks.

The whitepaper media is a **20-second stage montage of actual native screenshots,
not continuous real-time recording**. Each stage holds for four seconds. At the
rejoin stage the lower pane is explicitly labeled as the earlier A3 reference;
at recovery both panes are fresh captures. The fixture uses minimal triangular
meshes. The strict receipt gate does not claim the separate final composited
prefab-pixel gate, nor individual per-object CAS cache-hit counters.

Suggested narration: “Both clients receive the same Package update. With the
content server offline, retained content supports rollback and a fresh client
rejoin. After the authority restarts, the new lease restores the exact content
cut and existing world state without replaying construction or terrain edits.”

Public-safe outputs are `whitepaper/package-lifecycle-stages.mp4`,
`whitepaper/verification.json` and `whitepaper/README.md` under that run. Never
publish private certificates, worker environment files, or author/service tokens.