feat: publish HoloLake model-native living system source

2026-08-03 10:04:41 +08:00 · 2026-08-03 10:04:41 +08:00 · c395dd3a99
commit c395dd3a99
parent 6ad10edde1
2467 changed files with 615073 additions and 0 deletions
--- a/product-source/hololake-platform/guanghu-os/scripts/arm-native-physical-once.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/arm-native-physical-once.sh
@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 2 ]] || {
+  echo "usage: arm-native-physical-once.sh <world-root> <recovery-root>" >&2
+  exit 64
+}
+[[ ${EUID} -eq 0 ]] || {
+  echo "must run as root" >&2
+  exit 77
+}
+
+world_root=$(readlink -f "$1")
+recovery_root=$(readlink -f "$2")
+/guanghu/bin/ghctl authorize "${world_root}" reboot_and_recover_bs_sh_005 \
+  >/dev/null
+grep -q "menuentry 'Guanghu OS native one-time proof'.*'guanghu-native-once'" \
+  /boot/grub/grub.cfg
+
+proof_before=$(mktemp)
+trap 'rm -f "${proof_before}"' EXIT
+dd if=/dev/vda of="${proof_before}" bs=512 skip=50 count=1 status=none
+cmp -s "${proof_before}" <(head -c 512 /dev/zero)
+
+grub-editenv /boot/grub/grubenv unset initrdfail prev_entry next_entry
+grub-reboot guanghu-native-once
+grub_state=$(grub-editenv /boot/grub/grubenv list)
+grep -q '^next_entry=guanghu-native-once$' <<<"${grub_state}"
+if grep -Eq '^(initrdfail|prev_entry)=' <<<"${grub_state}"; then
+  echo "stale GRUB fallback state remains" >&2
+  exit 65
+fi
+
+previous_boot_id=$(cat /proc/sys/kernel/random/boot_id)
+observed_at=$(date --iso-8601=seconds)
+cat >"${recovery_root}/ARMED-RECEIPT.hldp" <<EOF
+schema: guanghu.native-physical-arm/v1
+receipt_id: GH-OS-LAB-001-NATIVE-PHYSICAL-ARM-001
+status: ARMED
+observed_at: ${observed_at}
+node_id: BS-SH-005
+previous_linux_boot_id: ${previous_boot_id}
+disk_proof_before:
+  lba: 50
+  state: EMPTY
+grub:
+  entry_id: guanghu-native-once
+  next_entry: VERIFIED
+  stale_initrd_fallback_state: CLEARED
+next_action: SYNC_AND_REBOOT
+EOF
+chmod 0400 "${recovery_root}/ARMED-RECEIPT.hldp"
+sync
+cat "${recovery_root}/ARMED-RECEIPT.hldp"
--- a/product-source/hololake-platform/guanghu-os/scripts/build-native-bios-image.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/build-native-bios-image.sh
@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 2 ]] || {
+  echo "usage: build-native-bios-image.sh <world-root> <output-directory>" >&2
+  exit 64
+}
+
+world_root=$(readlink -f "$1")
+output_root=$(readlink -m "$2")
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+native_root=${source_root}/native/x86_64-bios
+
+command -v nasm >/dev/null
+mkdir -p "${output_root}"
+cargo run --quiet --manifest-path "${source_root}/Cargo.toml" \
+  -p hldp-native-compiler -- "${world_root}" "${output_root}/world.inc"
+(
+  cd "${output_root}"
+  nasm -f bin -I "${output_root}/" -I "${native_root}/" "${native_root}/boot.asm" \
+    -o guanghu-os-x86_64-bios.img
+)
+[[ $(stat -c %s "${output_root}/guanghu-os-x86_64-bios.img") -eq 14848 ]]
+sha256sum "${output_root}/guanghu-os-x86_64-bios.img" \
+  >"${output_root}/guanghu-os-x86_64-bios.img.sha256"
--- a/product-source/hololake-platform/guanghu-os/scripts/build-native-physical-candidate.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/build-native-physical-candidate.sh
@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 2 ]] || {
+  echo "usage: build-native-physical-candidate.sh <world-root> <output-directory>" >&2
+  exit 64
+}
+
+world_root=$(readlink -f "$1")
+output_root=$(readlink -m "$2")
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+native_root=${source_root}/native/x86_64-bios
+
+command -v nasm >/dev/null
+mkdir -p "${output_root}"
+cargo run --quiet --manifest-path "${source_root}/Cargo.toml" \
+  -p hldp-native-compiler -- "${world_root}" "${output_root}/world.inc"
+(
+  cd "${output_root}"
+  nasm -f bin -I "${output_root}/" -I "${native_root}/" \
+    -dSTAGE2_LBA=35 \
+    -dGHOS_PHYSICAL_CANDIDATE=1 \
+    "${native_root}/boot.asm" \
+    -o guanghu-os-x86_64-bios-physical.img
+)
+[[ $(stat -c %s "${output_root}/guanghu-os-x86_64-bios-physical.img") -eq 14848 ]]
+sha256sum "${output_root}/guanghu-os-x86_64-bios-physical.img" \
+  >"${output_root}/guanghu-os-x86_64-bios-physical.img.sha256"
--- a/product-source/hololake-platform/guanghu-os/scripts/build-native-physical-probe.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/build-native-physical-probe.sh
@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 3 ]] || {
+  echo "usage: build-native-physical-probe.sh <world-root> <output-directory> <probe-stage>" >&2
+  exit 64
+}
+
+world_root=$(readlink -f "$1")
+output_root=$(readlink -m "$2")
+probe_stage=$3
+[[ ${probe_stage} =~ ^[1-9]$ ]]
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+native_root=${source_root}/native/x86_64-bios
+
+command -v nasm >/dev/null
+mkdir -p "${output_root}"
+cargo run --quiet --manifest-path "${source_root}/Cargo.toml" \
+  -p hldp-native-compiler -- "${world_root}" "${output_root}/world.inc"
+(
+  cd "${output_root}"
+  nasm -f bin -I "${output_root}/" -I "${native_root}/" \
+    -dSTAGE2_LBA=35 \
+    -dGHOS_PHYSICAL_CANDIDATE=1 \
+    -dGHOS_GHAL_PROBE_STAGE="${probe_stage}" \
+    "${native_root}/boot.asm" \
+    -o "guanghu-os-x86_64-bios-probe-${probe_stage}.img"
+)
+image=${output_root}/guanghu-os-x86_64-bios-probe-${probe_stage}.img
+[[ $(stat -c %s "${image}") -eq 14848 ]]
+sha256sum "${image}" >"${image}.sha256"
--- a/product-source/hololake-platform/guanghu-os/scripts/build-native-resident-candidate.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/build-native-resident-candidate.sh
@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 2 ]] || {
+  echo "usage: build-native-resident-candidate.sh <world-root> <output-directory>" >&2
+  exit 64
+}
+
+world_root=$(readlink -f "$1")
+output_root=$(readlink -m "$2")
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+native_root=${source_root}/native/x86_64-bios
+
+command -v nasm >/dev/null
+mkdir -p "${output_root}"
+cargo run --quiet --manifest-path "${source_root}/Cargo.toml" \
+  -p hldp-native-compiler -- "${world_root}" "${output_root}/world.inc"
+(
+  cd "${output_root}"
+  nasm -f bin -I "${output_root}/" -I "${native_root}/" \
+    -dSTAGE2_LBA=35 \
+    -dGHOS_PHYSICAL_CANDIDATE=1 \
+    -dGHOS_NATIVE_RESIDENT=1 \
+    "${native_root}/boot.asm" \
+    -o guanghu-os-x86_64-bios-resident.img
+)
+[[ $(stat -c %s "${output_root}/guanghu-os-x86_64-bios-resident.img") -eq 14848 ]]
+sha256sum "${output_root}/guanghu-os-x86_64-bios-resident.img" \
+  >"${output_root}/guanghu-os-x86_64-bios-resident.img.sha256"
--- a/product-source/hololake-platform/guanghu-os/scripts/clear-native-recovery-beacon.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/clear-native-recovery-beacon.sh
@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 2 ]] || {
+  echo "usage: clear-native-recovery-beacon.sh <disk> <clear-template>" >&2
+  exit 64
+}
+
+disk=$1
+clear_template=$2
+[[ -f ${clear_template} ]]
+[[ $(stat -c %s "${clear_template}" 2>/dev/null || stat -f %z "${clear_template}") -eq 1024 ]]
+
+if [[ -b ${disk} ]]; then
+  [[ ${EUID} -eq 0 ]]
+  [[ $(readlink -f "${disk}") == /dev/vda ]]
+elif [[ ! -f ${disk} ]]; then
+  echo "recovery beacon target is neither /dev/vda nor a test disk" >&2
+  exit 65
+fi
+
+readback=$(mktemp)
+trap 'rm -f "${readback}"' EXIT
+dd if="${disk}" of="${readback}" bs=512 skip=68 count=2 status=none
+
+if cmp -s "${readback}" "${clear_template}"; then
+  echo "GUANGHU_NATIVE_RECOVERY_BEACON_ALREADY_CLEAR"
+  exit 0
+fi
+
+if ! grep -aFq 'guanghu_recovery=ubuntu' "${readback}"; then
+  echo "unknown data occupies the recovery beacon sectors" >&2
+  exit 65
+fi
+
+dd if="${clear_template}" of="${disk}" bs=512 seek=68 count=2 \
+  conv=notrunc,fsync status=none
+dd if="${disk}" of="${readback}" bs=512 skip=68 count=2 status=none
+cmp "${readback}" "${clear_template}"
+echo "GUANGHU_NATIVE_RECOVERY_BEACON_CLEARED"
--- a/product-source/hololake-platform/guanghu-os/scripts/consume-ghal-physical-probe.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/consume-ghal-physical-probe.sh
@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 4 ]] || {
+  echo "usage: consume-ghal-physical-probe.sh <world-root> <recovery-root> <probe-stage> <receipt-destination>" >&2
+  exit 64
+}
+[[ ${EUID} -eq 0 ]] || {
+  echo "must run as root" >&2
+  exit 77
+}
+
+world_root=$(readlink -f "$1")
+recovery_root=$(readlink -f "$2")
+probe_stage=$3
+receipt_destination=$(readlink -m "$4")
+[[ ${probe_stage} =~ ^[1-9]$ ]]
+/guanghu/bin/ghctl authorize "${world_root}" \
+  write_bootloader_and_system_partitions >/dev/null
+
+proof=${recovery_root}/lba63.ghal-observation.bin
+observation=${recovery_root}/GHAL-DIAGNOSTIC-OBSERVATION.hldp
+[[ -f ${proof} && -f ${observation} ]]
+python3 - "${proof}" "${probe_stage}" <<'PY'
+import pathlib
+import sys
+
+proof = pathlib.Path(sys.argv[1]).read_bytes()
+stage = int(sys.argv[2])
+assert len(proof) == 512
+assert proof[0] == 0xA5
+assert proof[1:].startswith(b"GHOS_NATIVE_LONG64_DISK_PROOF\x00")
+assert proof[42] == 0x80 + stage
+assert proof[43] == 0
+PY
+install -o root -g root -m 0400 "${observation}" "${receipt_destination}"
+dd if=/dev/zero of=/dev/vda bs=512 seek=63 count=1 \
+  conv=notrunc,fsync status=none
+cleared=$(mktemp)
+trap 'rm -f "${cleared}"' EXIT
+dd if=/dev/vda of="${cleared}" bs=512 skip=63 count=1 status=none
+cmp -s "${cleared}" <(head -c 512 /dev/zero)
+observed_at=$(date --iso-8601=seconds)
+cat >"${recovery_root}/GHAL-PROBE-CONSUMPTION.hldp" <<EOF
+schema: guanghu.ghal-probe-consumption/v1
+receipt_id: GH-OS-LAB-001-GHAL-PROBE-${probe_stage}-CONSUMPTION
+status: VERIFIED_AND_CLEARED
+observed_at: ${observed_at}
+node_id: BS-SH-005
+probe_stage: ${probe_stage}
+proof_lba: 63
+proof_cleared: true
+observation_installed_at: ${receipt_destination}
+next_action: INSTALL_NEXT_GHAL_PROBE_STAGE
+EOF
+chmod 0400 "${recovery_root}/GHAL-PROBE-CONSUMPTION.hldp"
+cat "${recovery_root}/GHAL-PROBE-CONSUMPTION.hldp"
--- a/product-source/hololake-platform/guanghu-os/scripts/inspect-ghal-physical-return.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/inspect-ghal-physical-return.sh
@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 3 ]] || {
+  echo "usage: inspect-ghal-physical-return.sh <world-root> <recovery-root> <previous-boot-id>" >&2
+  exit 64
+}
+[[ ${EUID} -eq 0 ]] || {
+  echo "must run as root" >&2
+  exit 77
+}
+
+world_root=$(readlink -f "$1")
+recovery_root=$(readlink -f "$2")
+previous_boot_id=$3
+current_boot_id=$(cat /proc/sys/kernel/random/boot_id)
+[[ ${current_boot_id} != "${previous_boot_id}" ]]
+/guanghu/bin/ghctl authorize "${world_root}" reboot_and_recover_bs_sh_005 \
+  >/dev/null
+systemctl is-active --quiet guanghu-broadcast-tower.service
+systemctl is-active --quiet guanghu-code-channel.service
+
+proof_path=${recovery_root}/lba63.ghal-observation.bin
+receipt_path=${recovery_root}/GHAL-DIAGNOSTIC-OBSERVATION.hldp
+dd if=/dev/vda of="${proof_path}" bs=512 skip=63 count=1 status=none
+observed_at=$(date --iso-8601=seconds)
+python3 - "${proof_path}" "${receipt_path}" "${observed_at}" \
+  "${previous_boot_id}" "${current_boot_id}" <<'PY'
+import pathlib
+import sys
+
+proof_path = pathlib.Path(sys.argv[1])
+receipt_path = pathlib.Path(sys.argv[2])
+observed_at, previous_boot_id, current_boot_id = sys.argv[3:]
+proof = proof_path.read_bytes()
+assert len(proof) == 512
+assert proof[0] in (0xA5, 0xA7, 0xE1)
+assert proof[1:].startswith(b"GHOS_NATIVE_LONG64_DISK_PROOF\x00")
+
+if proof[0] == 0xA7:
+    result = "GHAL_DRIVER_OK"
+    status = "VERIFIED"
+elif proof[0] == 0xA5:
+    result = "GHAL_PROBE_RETURNED"
+    status = "VERIFIED_PROBE_STAGE"
+else:
+    result = "GHAL_FAILED_WITH_DIAGNOSTIC"
+    status = "FAILED_CLOSED_DIAGNOSTIC_OBSERVED"
+mac = ":".join(f"{byte:02x}" for byte in proof[36:42])
+gateway_mac = ":".join(f"{byte:02x}" for byte in proof[54:60])
+login_client_ip = ".".join(str(byte) for byte in proof[64:68])
+u16 = lambda offset: int.from_bytes(proof[offset:offset + 2], "little")
+text = f"""schema: guanghu.ghal-diagnostic-observation/v1
+receipt_id: GH-OS-LAB-001-GHAL-DIAGNOSTIC-OBSERVATION
+status: {status}
+observed_at: {observed_at}
+node_id: BS-SH-005
+instance_id: lhins-14w5y3ce
+boot:
+  previous_linux_boot_id: {previous_boot_id}
+  recovered_linux_boot_id: {current_boot_id}
+native_result:
+  result: {result}
+  proof_flag: 0x{proof[0]:02x}
+  stage: 0x{proof[42]:02x}
+  error: 0x{proof[43]:02x}
+  virtio_net_discovered: {str(bool(proof[32])).lower()}
+  virtio_block_discovered: {str(bool(proof[33])).lower()}
+  virtio_net_queue_ready: {str(bool(proof[34])).lower()}
+  virtio_block_queue_ready: {str(bool(proof[35])).lower()}
+  mac: {mac}
+  net_rx_queue_size: {u16(44)}
+  net_tx_queue_size: {u16(46)}
+  block_queue_size: {u16(48)}
+  net_io_base: 0x{u16(50):04x}
+  block_io_base: 0x{u16(52):04x}
+  gateway_mac: {gateway_mac}
+  arp_tx_complete: {str(bool(proof[60])).lower()}
+  arp_rx_verified: {str(bool(proof[61])).lower()}
+  ipv4_login_rx_verified: {str(bool(proof[62])).lower()}
+  icmp_login_reply_tx: {str(bool(proof[63])).lower()}
+  login_client_ip: {login_client_ip}
+  login_icmp_id_network_order: 0x{u16(68):04x}
+  login_icmp_sequence_network_order: 0x{u16(70):04x}
+  login_magic: {proof[72:88].decode("ascii", errors="replace")}
+  world_store_written: {str(bool(proof[88])).lower()}
+  world_store_read_verified: {str(bool(proof[89])).lower()}
+  login_reply_count: {proof[90]}
+  code_channel_store_written: {str(bool(proof[91])).lower()}
+  code_channel_store_read_verified: {str(bool(proof[92])).lower()}
+  code_commit_command_rx: {str(bool(proof[93])).lower()}
+  code_object_written: {str(bool(proof[94])).lower()}
+  code_object_read_verified: {str(bool(proof[95])).lower()}
+  branch_move_command_rx: {str(bool(proof[96])).lower()}
+  branch_receipt_written: {str(bool(proof[97])).lower()}
+  branch_receipt_read_verified: {str(bool(proof[98])).lower()}
+proof:
+  lba: 63
+  sha256: {__import__("hashlib").sha256(proof).hexdigest()}
+  cleared_after_observation: false
+next_action: CONSUME_PROOF_WITH_SUCCESS_VERIFIER_OR_SEAL_FAILURE_AND_CLEAR
+"""
+receipt_path.write_text(text)
+PY
+chmod 0400 "${proof_path}" "${receipt_path}"
+sync
+cat "${receipt_path}"
--- a/product-source/hololake-platform/guanghu-os/scripts/install-hosted-stage1.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/install-hosted-stage1.sh
@ -0,0 +1,213 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: sudo install-hosted-stage1.sh <guanghu-os-source> <source-sha> <archive-sha256>" >&2
+  exit 64
+}
+
+[[ $# -eq 3 ]] || usage
+[[ ${EUID} -eq 0 ]] || {
+  echo "install-hosted-stage1.sh must run as root" >&2
+  exit 77
+}
+
+source_root=$(readlink -f "$1")
+source_sha=$2
+archive_sha256=$3
+version=0.1.0-stage1
+install_root=/guanghu
+version_root=${install_root}/versions/${version}
+staging_root=${install_root}/versions/.${version}.installing
+export RUSTUP_HOME=/opt/guanghu/rustup
+export CARGO_HOME=/opt/guanghu/cargo
+export PATH=${CARGO_HOME}/bin:${PATH}
+
+[[ ${source_sha} =~ ^[0-9a-f]{40}$ ]] || {
+  echo "source SHA must be a full lowercase Git SHA" >&2
+  exit 65
+}
+[[ ${archive_sha256} =~ ^[0-9a-f]{64}$ ]] || {
+  echo "archive SHA-256 must be a full lowercase digest" >&2
+  exit 65
+}
+[[ -f ${source_root}/Cargo.toml && -f ${source_root}/world-seed/WORLD-MANIFEST.hldp ]] || {
+  echo "source root is not a Guanghu OS workspace" >&2
+  exit 66
+}
+[[ $(uname -m) == x86_64 ]] || {
+  echo "Stage 1 is pinned to the x86_64 Shanghai node" >&2
+  exit 69
+}
+[[ -b /dev/vda ]] || {
+  echo "expected Shanghai system disk /dev/vda is absent" >&2
+  exit 69
+}
+[[ ! -e ${version_root} ]] || {
+  echo "${version_root} already exists; immutable versions are never overwritten" >&2
+  exit 73
+}
+
+command -v cargo >/dev/null
+command -v rustc >/dev/null
+
+mkdir -p "${install_root}/versions" "${install_root}/bin"
+[[ ! -e ${staging_root} ]] || {
+  echo "stale staging directory exists: ${staging_root}" >&2
+  exit 73
+}
+mkdir -p "${staging_root}/bin"
+
+cleanup_staging() {
+  if [[ -d ${staging_root} ]]; then
+    mv "${staging_root}" "${staging_root}.failed.$(date -u +%Y%m%dT%H%M%SZ)"
+  fi
+}
+trap cleanup_staging ERR
+
+cd "${source_root}"
+cargo test --workspace --locked
+cargo build --release --locked -p ghctl
+
+cp -a world-seed/. "${staging_root}/"
+install -m 0755 target/release/ghctl "${staging_root}/bin/ghctl"
+
+observed_at=$(date --iso-8601=seconds)
+kernel=$(uname -r)
+rust_version=$(rustc --version | tr ' ' '_')
+cargo_version=$(cargo --version | tr ' ' '_')
+
+cat >"${staging_root}/CURRENT.hldp" <<EOF
+schema: guanghu.current/v1
+node_id: BS-SH-005
+lab_id: GH-OS-LAB-001
+phase: PHASE_1_WORLD_INSTALLED
+state: HOSTED_WORLD_OPERATIONAL
+authorization:
+  id: GH-OS-AUTH-BINGSHUO-BS-SH-005-001
+  status: ACTIVE
+  behavior: AUTO_EXECUTE_IN_SCOPE_WITHOUT_REPEAT_CONFIRMATION
+hosted_bootstrap:
+  os: Ubuntu 24.04.4 LTS
+  kernel: ${kernel}
+  architecture: x86_64
+  privilege: ubuntu_with_passwordless_sudo
+  direct_access: VERIFIED_STRICT_HOST_KEY
+  access_receipt: state/receipts/DIRECT-ACCESS-20260731.hldp
+native_state:
+  hldp_runtime: RUNNING_HOSTED
+  five_domains: INSTALLED_AND_VALIDATED
+  broadcast_tower: REGISTERED_NOT_RUNNING
+  code_channel_control_plane: HLDP_CONTRACT_DEFINED_NOT_RUNNING
+  code_channel_data_plane: SOURCE_BASELINE_VERIFIED_NOT_RUNNING
+  native_kernel: NOT_IMPLEMENTED
+  boot_image: NOT_CREATED
+  linux_exited: false
+source:
+  implementation_commit: ${source_sha}
+  installation_archive_sha256: ${archive_sha256}
+next_action:
+  - start_hosted_broadcast_tower
+  - start_code_channel_hosted_data_plane
+  - implement_hldp_native_control_plane
+  - build_and_validate_native_kernel
+EOF
+
+cat >"${staging_root}/state/receipts/PHASE-1-WORLD-INSTALLED.hldp" <<EOF
+schema: guanghu.phase-receipt/v1
+receipt_id: GH-OS-LAB-001-PHASE-1-WORLD-INSTALLED
+node_id: BS-SH-005
+instance_id: lhins-14w5y3ce
+phase: PHASE_1_WORLD_INSTALLED
+status: VERIFIED
+observed_at: ${observed_at}
+source:
+  implementation_repository: REPO-008
+  implementation_commit: ${source_sha}
+  installation_archive_sha256: ${archive_sha256}
+runtime:
+  mode: HOSTED_BOOTSTRAP
+  host_operating_system: Ubuntu 24.04.4 LTS
+  host_kernel: ${kernel}
+  architecture: x86_64
+  rustc: ${rust_version}
+  cargo: ${cargo_version}
+prior_attempts:
+  - id: PHASE_1_INSTALL_ATTEMPT_001
+    status: FAILED_CLOSED
+    cause: UBUNTU_CARGO_1_75_CANNOT_READ_LOCKFILE_V4
+    activation_changed: false
+    evidence_directory: /guanghu/versions/.0.1.0-stage1.installing.failed.20260731T074748Z
+verified:
+  - workspace_tests_passed_on_server
+  - release_ghctl_built_on_server
+  - five_domain_world_manifest_validated
+  - dedicated_access_receipt_readable
+  - standing_authorization_readable
+not_yet_true:
+  - broadcast_tower_running
+  - hosted_forgejo_running
+  - native_kernel_booted
+  - linux_replaced
+rollback:
+  previous_current_symlink: preserved_until_atomic_activation
+  provider_reinstall_path: Tencent Cloud Lighthouse console
+next_action: PHASE_1B_HOSTED_BROADCAST_AND_CODE_CHANNEL
+EOF
+
+python3 - "${staging_root}/WORLD-MANIFEST.hldp" <<'PY'
+from pathlib import Path
+import sys
+
+path = Path(sys.argv[1])
+text = path.read_text()
+old = "last_receipt: state/receipts/PHASE-0-PREFLIGHT.hldp"
+new = "last_receipt: state/receipts/PHASE-1-WORLD-INSTALLED.hldp"
+if text.count(old) != 1:
+    raise SystemExit("WORLD-MANIFEST phase receipt anchor is missing or ambiguous")
+path.write_text(text.replace(old, new))
+PY
+
+python3 - "${staging_root}/WAKE.hldp" <<'PY'
+from pathlib import Path
+import sys
+
+path = Path(sys.argv[1])
+text = path.read_text()
+text = text.replace(
+    "status: PREFLIGHT_VERIFIED_WORLD_NOT_INSTALLED",
+    "status: HOSTED_WORLD_INSTALLED",
+)
+text = text.replace(
+    "  - state/receipts/PHASE-0-PREFLIGHT.hldp",
+    "  - state/receipts/PHASE-1-WORLD-INSTALLED.hldp",
+)
+path.write_text(text)
+PY
+
+"${staging_root}/bin/ghctl" wake "${staging_root}" >/tmp/guanghu-stage1-wake.txt
+grep -q '^GUANGHU_WORLD_OK$' /tmp/guanghu-stage1-wake.txt
+grep -q '^domains=5$' /tmp/guanghu-stage1-wake.txt
+grep -q '^last_receipt=state/receipts/PHASE-1-WORLD-INSTALLED.hldp$' /tmp/guanghu-stage1-wake.txt
+grep -q '^authorization=GH-OS-AUTH-BINGSHUO-BS-SH-005-001$' /tmp/guanghu-stage1-wake.txt
+
+cat >"${staging_root}/INSTALLATION.hldp" <<EOF
+schema: guanghu.installation/v1
+node_id: BS-SH-005
+version: ${version}
+source_sha: ${source_sha}
+archive_sha256: ${archive_sha256}
+installed_at: ${observed_at}
+immutable: true
+activation: /guanghu/current
+recovery_entry: /guanghu/bin/ghctl wake /guanghu/current
+EOF
+
+chmod -R a-w "${staging_root}"
+mv "${staging_root}" "${version_root}"
+ln -sfn "${version_root}" "${install_root}/current.next"
+mv -Tf "${install_root}/current.next" "${install_root}/current"
+ln -sfn "${install_root}/current/bin/ghctl" "${install_root}/bin/ghctl"
+trap - ERR
+
+"${install_root}/bin/ghctl" wake "${install_root}/current"
--- a/product-source/hololake-platform/guanghu-os/scripts/install-hosted-stage1b-services.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/install-hosted-stage1b-services.sh
@ -0,0 +1,432 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: sudo install-hosted-stage1b-services.sh <guanghu-os-source> <source-sha> <archive-sha256> <forgejo-offline-dir>" >&2
+  exit 64
+}
+
+[[ $# -eq 4 ]] || usage
+[[ ${EUID} -eq 0 ]] || {
+  echo "install-hosted-stage1b-services.sh must run as root" >&2
+  exit 77
+}
+
+source_root=$(readlink -f "$1")
+source_sha=$2
+archive_sha256=$3
+offline_root=$(readlink -f "$4")
+version=0.1.2-stage1b-r1
+install_root=/guanghu
+version_root=${install_root}/versions/${version}
+staging_root=${install_root}/versions/.${version}.installing
+previous_current=$(readlink -f "${install_root}/current")
+activation_changed=false
+export RUSTUP_HOME=/opt/guanghu/rustup
+export CARGO_HOME=/opt/guanghu/cargo
+export PATH=${CARGO_HOME}/bin:${PATH}
+
+[[ ${source_sha} =~ ^[0-9a-f]{40}$ ]] || {
+  echo "source SHA must be a full lowercase Git SHA" >&2
+  exit 65
+}
+[[ ${archive_sha256} =~ ^[0-9a-f]{64}$ ]] || {
+  echo "archive SHA-256 must be a full lowercase digest" >&2
+  exit 65
+}
+[[ ${previous_current} == /guanghu/versions/0.1.1-stage1b ]] || {
+  echo "Stage 1B revision requires the exact active Stage 1B world" >&2
+  exit 69
+}
+[[ -f ${source_root}/Cargo.toml && -f ${source_root}/world-seed/WORLD-MANIFEST.hldp ]] || {
+  echo "source root is not a Guanghu OS workspace" >&2
+  exit 66
+}
+[[ -f ${offline_root}/MANIFEST.sha256 ]] || {
+  echo "Forgejo offline manifest is missing" >&2
+  exit 66
+}
+[[ ! -e ${version_root} && ! -e ${staging_root} ]] || {
+  echo "Stage 1B version or staging path already exists" >&2
+  exit 73
+}
+
+cleanup_failed_install() {
+  systemctl stop guanghu-broadcast-tower.service guanghu-code-channel.service >/dev/null 2>&1 || true
+  if ${activation_changed}; then
+    ln -sfn "${previous_current}" "${install_root}/current.rollback"
+    mv -Tf "${install_root}/current.rollback" "${install_root}/current"
+    ln -sfn "${install_root}/current/bin/ghctl" "${install_root}/bin/ghctl"
+  fi
+  if [[ -d ${staging_root} ]]; then
+    mv "${staging_root}" "${staging_root}.failed.$(date -u +%Y%m%dT%H%M%SZ)"
+  elif [[ -d ${version_root} ]]; then
+    mv "${version_root}" "${version_root}.failed.$(date -u +%Y%m%dT%H%M%SZ)"
+  fi
+}
+trap cleanup_failed_install ERR
+
+(cd "${offline_root}" && sha256sum -c MANIFEST.sha256)
+grep -q '^b3d7e4ac3cbccc220703097a51fa4c16bf302579 refs/heads/guanghu/main$' \
+  < <(git bundle list-heads "${offline_root}/guanghu-code-channel.bundle")
+
+cd "${source_root}"
+cargo test --workspace --locked
+cargo build --release --locked -p ghctl -p guanghu-broadcast-tower
+
+cp -a "${source_root}/world-seed" "${staging_root}"
+chmod -R u+w "${staging_root}"
+mkdir -p "${staging_root}/bin"
+install -m 0755 target/release/ghctl "${staging_root}/bin/ghctl"
+install -m 0755 target/release/guanghu-broadcast-tower \
+  "${staging_root}/bin/guanghu-broadcast-tower"
+
+observed_at=$(date --iso-8601=seconds)
+kernel=$(uname -r)
+
+cat >"${staging_root}/CURRENT.hldp" <<EOF
+schema: guanghu.current/v1
+node_id: BS-SH-005
+lab_id: GH-OS-LAB-001
+phase: PHASE_1B_HOSTED_SERVICES
+state: HOSTED_WORLD_AND_SERVICES_OPERATIONAL
+authorization:
+  id: GH-OS-AUTH-BINGSHUO-BS-SH-005-001
+  status: ACTIVE
+  behavior: AUTO_EXECUTE_IN_SCOPE_WITHOUT_REPEAT_CONFIRMATION
+hosted_bootstrap:
+  os: Ubuntu 24.04.4 LTS
+  kernel: ${kernel}
+  architecture: x86_64
+  direct_access: VERIFIED_STRICT_HOST_KEY
+  broadcast_address: 127.0.0.1:8077
+  code_channel_address: 127.0.0.1:3080
+native_state:
+  hldp_runtime: RUNNING_HOSTED
+  five_domains: INSTALLED_AND_VALIDATED
+  broadcast_tower: RUNNING_HOSTED_SINGLETON
+  code_channel_control_plane: HLDP_CONTRACT_DEFINED_NOT_RUNNING
+  code_channel_data_plane: FORGEJO_16_0_1_RUNNING_HOSTED
+  native_kernel: NOT_IMPLEMENTED
+  boot_image: NOT_CREATED
+  linux_exited: false
+source:
+  implementation_commit: ${source_sha}
+  installation_archive_sha256: ${archive_sha256}
+next_action:
+  - implement_hldp_native_code_channel_control_plane
+  - build_gosk_minimum_kernel
+  - validate_native_boot_in_virtual_machine
+EOF
+
+cat >"${staging_root}/state/receipts/PHASE-1B-HOSTED-SERVICES.hldp" <<EOF
+schema: guanghu.phase-receipt/v1
+receipt_id: GH-OS-LAB-001-PHASE-1B-HOSTED-SERVICES
+node_id: BS-SH-005
+instance_id: lhins-14w5y3ce
+phase: PHASE_1B_HOSTED_SERVICES
+status: VERIFIED
+observed_at: ${observed_at}
+source:
+  implementation_commit: ${source_sha}
+  installation_archive_sha256: ${archive_sha256}
+correction:
+  supersedes_version: 0.1.1-stage1b
+  reason: WORLD_MANIFEST_VERSION_AND_PHASE_LAGGED_BEHIND_CURRENT
+  detected_by: MAC_SSH_TUNNEL_EXTERNAL_HEALTH_READBACK
+services:
+  broadcast_tower:
+    unit: guanghu-broadcast-tower.service
+    address: 127.0.0.1:8077
+    authority_language: HLDP
+    runtime: HOSTED_BOOTSTRAP
+  code_channel:
+    unit: guanghu-code-channel.service
+    address: 127.0.0.1:3080
+    engine: Forgejo 16.0.1
+    role: TEMPORARY_HOSTED_DATA_PLANE
+prior_attempts:
+  - id: PHASE_1B_INSTALL_ATTEMPT_001
+    status: FAILED_CLOSED
+    cause: FORGEJO_FIRST_MIGRATION_REQUIRED_TEMPORARY_CONFIG_WRITE
+    activation_changed: false
+    evidence_directory: /guanghu/versions/.0.1.1-stage1b.installing.failed.20260731T082343Z
+  - id: PHASE_1B_INSTALL_ATTEMPT_002
+    status: FAILED_CLOSED
+    cause: RELATIVE_SOURCE_ROOT_INVALID_AFTER_BUILD_DIRECTORY_CHANGE
+    activation_changed: false
+    evidence_directory: /guanghu/versions/.0.1.1-stage1b.installing.failed.20260731T082554Z
+  - id: PHASE_1B_INSTALL_ATTEMPT_003
+    status: FAILED_CLOSED
+    cause: HEALTH_PROBE_RAN_BEFORE_FORGEJO_OPENED_LISTENER
+    activation_changed: rolled_back
+    evidence_directory: /guanghu/versions/0.1.1-stage1b.failed.20260731T082820Z
+verified:
+  - broadcast_tower_health_returns_registered_five_domain_world
+  - broadcast_epoch_written_by_live_process
+  - forgejo_health_endpoint_returns_success
+  - offline_manifest_sha256_entries_match_on_server
+  - product_bundle_contains_exact_guanghu_main_commit
+  - source_bundle_preserved_on_server
+not_yet_true:
+  - hldp_native_code_channel_control_plane_running
+  - gosk_native_repository_data_plane_running
+  - native_kernel_booted
+  - linux_replaced
+next_action: PHASE_2_HLDP_NATIVE_CONTROL_PLANE
+EOF
+
+cat >"${staging_root}/state/receipts/CODE-CHANNEL-HOSTED.hldp" <<EOF
+schema: guanghu.code-channel-receipt/v1
+receipt_id: GH-OS-LAB-001-CODE-CHANNEL-HOSTED
+channel_id: HLP-MOD-CODE-CHANNEL
+phase: PHASE_1_HOSTED_DATA_PLANE
+status: VERIFIED
+observed_at: ${observed_at}
+engine:
+  name: Forgejo
+  version: 16.0.1
+  binary_sha256: 7a4c568136650c10498a9d3d62c7fd630a0cf09c166293ebd78708248f6398fc
+source:
+  product_branch: guanghu/main
+  product_commit: b3d7e4ac3cbccc220703097a51fa4c16bf302579
+  product_bundle_sha256: fc53740259d108128e69f5a809cec438ecf3158175617574ba55b8612c5eaa6c
+  upstream_bundle_sha256: c33bd074d9b2896259e86ebe03ad31ccdd8ff71897beed4320081fa03b15381f
+runtime:
+  address: 127.0.0.1:3080
+  exposure: LOOPBACK_ONLY
+  database: sqlite
+  registration_disabled: true
+  ssh_server_disabled: true
+authority:
+  language: HLDP
+  forgejo_is_os: false
+  native_acceptance: false
+next_action: PHASE_2_HLDP_NATIVE_CONTROL_PLANE
+EOF
+
+python3 - "${staging_root}" <<'PY'
+from pathlib import Path
+import sys
+
+root = Path(sys.argv[1])
+
+def replace(path, old, new):
+    text = path.read_text()
+    if text.count(old) != 1:
+        raise SystemExit(f"{path}: anchor missing or ambiguous: {old}")
+    path.write_text(text.replace(old, new))
+
+replace(
+    root / "WORLD-MANIFEST.hldp",
+    "version: 0.1.0-stage1",
+    "version: 0.1.2-stage1b-r1",
+)
+replace(
+    root / "WORLD-MANIFEST.hldp",
+    "phase: HOSTED_BOOTSTRAP_PROTOTYPE",
+    "phase: HOSTED_SERVICES_BOOTSTRAP",
+)
+replace(
+    root / "WORLD-MANIFEST.hldp",
+    "state: REGISTERED_NOT_RUNNING",
+    "state: RUNNING_HOSTED",
+)
+replace(
+    root / "WORLD-MANIFEST.hldp",
+    "last_receipt: state/receipts/CODE-CHANNEL-BASELINE.hldp",
+    "last_receipt: state/receipts/CODE-CHANNEL-HOSTED.hldp",
+)
+replace(
+    root / "WORLD-MANIFEST.hldp",
+    "last_receipt: state/receipts/PHASE-0-PREFLIGHT.hldp",
+    "last_receipt: state/receipts/PHASE-1B-HOSTED-SERVICES.hldp",
+)
+replace(
+    root / "WAKE.hldp",
+    "status: PREFLIGHT_VERIFIED_WORLD_NOT_INSTALLED",
+    "status: HOSTED_WORLD_AND_SERVICES_RUNNING",
+)
+replace(
+    root / "WAKE.hldp",
+    "state/receipts/PHASE-0-PREFLIGHT.hldp",
+    "state/receipts/PHASE-1B-HOSTED-SERVICES.hldp",
+)
+replace(
+    root / "WAKE.hldp",
+    "state/receipts/CODE-CHANNEL-BASELINE.hldp",
+    "state/receipts/CODE-CHANNEL-HOSTED.hldp",
+)
+replace(
+    root / "world/services/code-channel/CHANNEL.hldp",
+    "state: SOURCE_BASELINE_VERIFIED_RUNTIME_NOT_INSTALLED",
+    "state: HOSTED_DATA_PLANE_RUNNING",
+)
+replace(
+    root / "world/services/code-channel/CHANNEL.hldp",
+    "current_phase: PHASE_0_SOURCE_BASELINE_VERIFIED",
+    "current_phase: PHASE_1_HOSTED_DATA_PLANE",
+)
+replace(
+    root / "world/services/code-channel/CHANNEL.hldp",
+    "    - id: PHASE_1_HOSTED_DATA_PLANE\n      state: PENDING",
+    "    - id: PHASE_1_HOSTED_DATA_PLANE\n      state: COMPLETE",
+)
+replace(
+    root / "world/services/code-channel/CHANNEL.hldp",
+    "last_receipt: state/receipts/CODE-CHANNEL-BASELINE.hldp",
+    "last_receipt: state/receipts/CODE-CHANNEL-HOSTED.hldp",
+)
+replace(
+    root / "world/services/code-channel/CHANNEL.hldp",
+    "next_action: install_verified_offline_baseline_as_hosted_data_plane",
+    "next_action: implement_hldp_native_control_plane",
+)
+PY
+
+"${staging_root}/bin/ghctl" wake "${staging_root}" >/tmp/guanghu-stage1b-wake.txt
+grep -q '^GUANGHU_WORLD_OK$' /tmp/guanghu-stage1b-wake.txt
+grep -q '^domains=5$' /tmp/guanghu-stage1b-wake.txt
+grep -q '^last_receipt=state/receipts/PHASE-1B-HOSTED-SERVICES.hldp$' \
+  /tmp/guanghu-stage1b-wake.txt
+
+getent passwd guanghu >/dev/null || \
+  useradd --system --home-dir /nonexistent --shell /usr/sbin/nologin guanghu
+getent passwd forgejo >/dev/null || \
+  useradd --system --home-dir /guanghu/code-channel --shell /usr/sbin/nologin forgejo
+
+install -d -o guanghu -g guanghu -m 0750 "${install_root}/var/broadcast-tower"
+install -d -o root -g forgejo -m 0750 \
+  "${install_root}/code-channel" \
+  "${install_root}/code-channel/bin" \
+  "${install_root}/code-channel/custom" \
+  "${install_root}/code-channel/custom/conf" \
+  "${install_root}/code-channel/offline"
+install -d -o forgejo -g forgejo -m 0750 \
+  "${install_root}/code-channel/data" \
+  "${install_root}/code-channel/data/repositories" \
+  "${install_root}/code-channel/data/bootstrap-repositories" \
+  "${install_root}/code-channel/log"
+
+install -m 0755 "${offline_root}/forgejo-16.0.1-linux-amd64" \
+  "${install_root}/code-channel/bin/forgejo-16.0.1"
+for artifact in MANIFEST.sha256 forgejo-16.0.1-linux-amd64.asc \
+  forgejo-release-key.asc forgejo-upstream-all.bundle guanghu-code-channel.bundle; do
+  install -o root -g forgejo -m 0640 "${offline_root}/${artifact}" \
+    "${install_root}/code-channel/offline/${artifact}"
+done
+
+cat >"${install_root}/code-channel/custom/conf/app.ini" <<'EOF'
+APP_NAME = 光湖代码频道 · Hosted Construction Data Plane
+RUN_USER = forgejo
+RUN_MODE = prod
+WORK_PATH = /guanghu/code-channel
+
+[database]
+DB_TYPE = sqlite3
+PATH = /guanghu/code-channel/data/forgejo.db
+
+[repository]
+ROOT = /guanghu/code-channel/data/repositories
+
+[server]
+DOMAIN = 127.0.0.1
+HTTP_ADDR = 127.0.0.1
+HTTP_PORT = 3080
+ROOT_URL = http://127.0.0.1:3080/
+DISABLE_SSH = true
+OFFLINE_MODE = true
+
+[service]
+DISABLE_REGISTRATION = true
+REQUIRE_SIGNIN_VIEW = false
+
+[security]
+INSTALL_LOCK = true
+
+[log]
+MODE = console
+LEVEL = Info
+ROOT_PATH = /guanghu/code-channel/log
+EOF
+chown forgejo:forgejo "${install_root}/code-channel/custom/conf/app.ini"
+chmod 0600 "${install_root}/code-channel/custom/conf/app.ini"
+
+runuser -u forgejo -- env HOME=/guanghu/code-channel \
+  FORGEJO_WORK_DIR=/guanghu/code-channel \
+  "${install_root}/code-channel/bin/forgejo-16.0.1" migrate \
+  --config "${install_root}/code-channel/custom/conf/app.ini"
+chown root:forgejo "${install_root}/code-channel/custom/conf/app.ini"
+chmod 0640 "${install_root}/code-channel/custom/conf/app.ini"
+
+bootstrap_repo="${install_root}/code-channel/data/bootstrap-repositories/guanghu-code-channel.git"
+if [[ ! -d ${bootstrap_repo} ]]; then
+  runuser -u forgejo -- git clone --bare \
+    "${install_root}/code-channel/offline/guanghu-code-channel.bundle" \
+    "${bootstrap_repo}"
+fi
+[[ $(git --git-dir="${bootstrap_repo}" rev-parse refs/heads/guanghu/main) == \
+  b3d7e4ac3cbccc220703097a51fa4c16bf302579 ]]
+
+install -m 0644 "${source_root}/packaging/systemd/guanghu-broadcast-tower.service" \
+  /etc/systemd/system/guanghu-broadcast-tower.service
+install -m 0644 "${source_root}/packaging/systemd/guanghu-code-channel.service" \
+  /etc/systemd/system/guanghu-code-channel.service
+
+cat >"${staging_root}/INSTALLATION.hldp" <<EOF
+schema: guanghu.installation/v1
+node_id: BS-SH-005
+version: ${version}
+source_sha: ${source_sha}
+archive_sha256: ${archive_sha256}
+installed_at: ${observed_at}
+immutable: true
+activation: /guanghu/current
+recovery_entry: /guanghu/bin/ghctl wake /guanghu/current
+EOF
+
+mv "${staging_root}" "${version_root}"
+ln -sfn "${version_root}" "${install_root}/current.next"
+mv -Tf "${install_root}/current.next" "${install_root}/current"
+ln -sfn "${install_root}/current/bin/ghctl" "${install_root}/bin/ghctl"
+ln -sfn "${install_root}/current/bin/guanghu-broadcast-tower" \
+  "${install_root}/bin/guanghu-broadcast-tower"
+activation_changed=true
+
+systemctl daemon-reload
+systemctl enable guanghu-broadcast-tower.service guanghu-code-channel.service
+systemctl restart guanghu-broadcast-tower.service guanghu-code-channel.service
+
+wait_for_http() {
+  local url=$1
+  local output=$2
+  local label=$3
+  for attempt in $(seq 1 30); do
+    if curl --fail --silent --show-error "${url}" >"${output}" 2>/dev/null; then
+      return 0
+    fi
+    if ! systemctl is-active --quiet "${label}"; then
+      journalctl -u "${label}" -n 80 --no-pager >&2
+      return 1
+    fi
+    sleep 1
+  done
+  echo "timed out waiting for ${label} at ${url}" >&2
+  journalctl -u "${label}" -n 80 --no-pager >&2
+  return 1
+}
+
+wait_for_http http://127.0.0.1:8077/healthz \
+  /tmp/guanghu-broadcast-health.json guanghu-broadcast-tower.service
+wait_for_http http://127.0.0.1:3080/api/healthz \
+  /tmp/guanghu-code-channel-health.json guanghu-code-channel.service
+grep -q '"domain_count":5' /tmp/guanghu-broadcast-health.json
+grep -q '"linux_exited":false' /tmp/guanghu-broadcast-health.json
+grep -q 'status: RUNNING_HOSTED' "${install_root}/var/broadcast-tower/LIVE.hldp"
+
+chmod -R a-w "${version_root}"
+trap - ERR
+
+"${install_root}/bin/ghctl" wake "${install_root}/current"
+systemctl --no-pager --full status \
+  guanghu-broadcast-tower.service guanghu-code-channel.service
--- a/product-source/hololake-platform/guanghu-os/scripts/prepare-native-physical-once.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/prepare-native-physical-once.sh
@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 4 ]] || {
+  echo "usage: prepare-native-physical-once.sh <world-root> <candidate-image> <disk> <recovery-root>" >&2
+  exit 64
+}
+[[ ${EUID} -eq 0 ]] || {
+  echo "must run as root" >&2
+  exit 77
+}
+
+world_root=$(readlink -f "$1")
+candidate=$(readlink -f "$2")
+disk=$(readlink -f "$3")
+recovery_root=$(readlink -m "$4")
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+render_root=$(mktemp -d)
+trap 'rm -rf "${render_root}"' EXIT
+
+[[ ${disk} == /dev/vda ]]
+grep -q '^node_id: BS-SH-005$' "${world_root}/CURRENT.hldp"
+/guanghu/bin/ghctl authorize "${world_root}" write_bootloader_and_system_partitions \
+  >/dev/null
+[[ $(stat -c %s "${candidate}") -eq 14848 ]]
+
+partition_dump=$(sfdisk -d "${disk}")
+grep -q '^label: gpt$' <<<"${partition_dump}"
+grep -q '^label-id: E549327B-8DC7-4797-944F-DC6185D1B550$' \
+  <<<"${partition_dump}"
+grep -Eq '^/dev/vda1 : start= *2048, size= *2048,' <<<"${partition_dump}"
+grep -Eq '^/dev/vda2 : start= *4096, size= *104853471,' <<<"${partition_dump}"
+
+mkdir -p "${recovery_root}"
+chmod 0700 "${recovery_root}"
+printf '%s\n' "${partition_dump}" >"${recovery_root}/sfdisk-before.txt"
+dd if="${disk}" of="${recovery_root}/first-2MiB.before.bin" \
+  bs=1M count=2 status=none
+disk_sectors=$(blockdev --getsz "${disk}")
+dd if="${disk}" of="${recovery_root}/last-2MiB.before.bin" \
+  bs=512 skip=$((disk_sectors - 4096)) count=4096 status=none
+dd if="${disk}" of="${recovery_root}/lba34-62.before.bin" \
+  bs=512 skip=34 count=29 status=none
+if ! cmp -s "${recovery_root}/lba34-62.before.bin" \
+  <(head -c 14848 /dev/zero); then
+  echo "candidate sectors 34-62 are not empty" >&2
+  exit 65
+fi
+dd if="${disk}" of="${recovery_root}/lba63.before.bin" \
+  bs=512 skip=63 count=1 status=none
+if ! cmp -s "${recovery_root}/lba63.before.bin" \
+  <(head -c 512 /dev/zero); then
+  echo "native proof sector 63 is not empty" >&2
+  exit 65
+fi
+"${source_root}/scripts/render-native-recovery-beacon.sh" "${render_root}"
+dd if="${disk}" of="${recovery_root}/lba68-69.before.bin" \
+  bs=512 skip=68 count=2 status=none
+if ! cmp -s "${recovery_root}/lba68-69.before.bin" \
+  <(head -c 1024 /dev/zero) &&
+  ! cmp -s "${recovery_root}/lba68-69.before.bin" \
+    "${render_root}/guanghu-recovery-clear.env"; then
+  echo "native recovery beacon sectors 68-69 contain unknown data" >&2
+  exit 65
+fi
+dd if="${disk}" of="${recovery_root}/lba70-71.before.bin" \
+  bs=512 skip=70 count=2 status=none
+if ! cmp -s "${recovery_root}/lba70-71.before.bin" \
+  <(head -c 1024 /dev/zero); then
+  echo "native gestational index sectors 70-71 are not empty before first installation" >&2
+  exit 65
+fi
+
+cp /boot/grub/grub.cfg "${recovery_root}/grub.cfg.before"
+cp /boot/grub/grubenv "${recovery_root}/grubenv.before"
+cp /etc/default/grub "${recovery_root}/default-grub.before"
+cp /etc/grub.d/40_custom "${recovery_root}/40_custom.before"
+tar -czf "${recovery_root}/etc-grub.d.before.tar.gz" -C /etc grub.d
+cp "${candidate}" "${recovery_root}/guanghu-os-physical-candidate.img"
+
+install -m 0755 /dev/stdin /etc/grub.d/41_guanghu_native_once <<'EOF'
+#!/bin/sh
+exec tail -n +3 $0
+menuentry 'Guanghu OS native one-time proof' --id 'guanghu-native-once' {
+    insmod chain
+    chainloader (hd0)34+1
+}
+EOF
+dd if="${render_root}/guanghu-recovery-clear.env" of="${disk}" \
+  bs=512 seek=68 count=2 conv=notrunc,fsync status=none
+install -m 0755 "${render_root}/08_guanghu_native_recovery" \
+  /etc/grub.d/08_guanghu_native_recovery
+update-grub >/dev/null
+grub-script-check /boot/grub/grub.cfg
+grep -q "load_env --file '(hd0)68+2' guanghu_recovery" /boot/grub/grub.cfg
+grep -q "menuentry 'Guanghu OS native one-time proof'.*'guanghu-native-once'" \
+  /boot/grub/grub.cfg
+
+dd if="${candidate}" of="${disk}" bs=512 seek=34 count=29 \
+  conv=notrunc,fsync status=none
+candidate_sha=$(sha256sum "${candidate}" | awk '{print $1}')
+readback_sha=$(dd if="${disk}" bs=512 skip=34 count=29 status=none |
+  sha256sum | awk '{print $1}')
+[[ ${candidate_sha} == "${readback_sha}" ]]
+
+sha256sum "${recovery_root}"/* >"${recovery_root}/SHA256SUMS"
+chmod 0400 "${recovery_root}"/*
+observed_at=$(date --iso-8601=seconds)
+cat >"${recovery_root}/PREPARE-RECEIPT.hldp" <<EOF
+schema: guanghu.native-physical-prepare/v1
+receipt_id: GH-OS-LAB-001-NATIVE-PHYSICAL-PREPARE-001
+status: VERIFIED
+observed_at: ${observed_at}
+node_id: BS-SH-005
+instance_id: lhins-14w5y3ce
+disk:
+  path: /dev/vda
+  candidate_start_lba: 34
+  candidate_sector_count: 29
+  proof_lba: 63
+  recovery_beacon_lba_start: 68
+  recovery_beacon_sector_count: 2
+  gestational_index_lba_start: 70
+  gestational_index_sector_count: 2
+  existing_partition_start_lba: 2048
+candidate:
+  sha256: ${candidate_sha}
+  readback_sha256: ${readback_sha}
+grub:
+  entry_id: guanghu-native-once
+  recovery_protocol: GHNRP
+  recovery_raw_blocklist: (hd0)68+2
+  armed: false
+recovery:
+  directory: ${recovery_root}
+  first_2mib_backed_up: true
+  last_2mib_backed_up: true
+  partition_table_backed_up: true
+  grub_configuration_backed_up: true
+  proof_sector_backed_up: true
+  recovery_beacon_backed_up: true
+  gestational_index_backed_up: true
+next_action: ARM_ONE_TIME_ENTRY_AND_REBOOT
+EOF
+chmod 0400 "${recovery_root}/PREPARE-RECEIPT.hldp"
+cat "${recovery_root}/PREPARE-RECEIPT.hldp"
--- a/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py
+++ b/product-source/hololake-platform/guanghu-os/scripts/qemu-native-net-peer.py
@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+import argparse
+import socket
+import struct
+import time
+
+
+GUEST_MAC = bytes.fromhex("525400267198")
+PEER_MAC = bytes.fromhex("525400123401")
+GUEST_IP = socket.inet_aton("10.0.0.7")
+PEER_IP = socket.inet_aton("10.0.0.1")
+LOGIN_CLIENT_IP = socket.inet_aton("10.0.0.2")
+LOGIN_MAGIC = b"HLDP-GHOS-LOGIN!"
+COMMIT_MAGIC = b"HLDP-CODE-COMMIT"
+BRANCH_MAGIC = b"HLDP-BRANCH-MOVE"
+RECOVERY_MAGIC = b"HLDP-RECOVER-OS!"
+
+
+def checksum(payload: bytes) -> int:
+    if len(payload) % 2:
+        payload += b"\0"
+    words = struct.unpack(f"!{len(payload) // 2}H", payload)
+    total = sum(words)
+    while total >> 16:
+        total = (total & 0xFFFF) + (total >> 16)
+    return (~total) & 0xFFFF
+
+
+def arp_reply(request: bytes) -> bytes:
+    assert request[12:14] == b"\x08\x06"
+    assert request[20:22] == b"\x00\x01"
+    sender_mac = request[22:28]
+    sender_ip = request[28:32]
+    target_ip = request[38:42]
+    assert sender_mac == GUEST_MAC
+    assert sender_ip == GUEST_IP
+    assert target_ip == PEER_IP
+    return (
+        sender_mac
+        + PEER_MAC
+        + b"\x08\x06"
+        + b"\x00\x01\x08\x00\x06\x04\x00\x02"
+        + PEER_MAC
+        + PEER_IP
+        + sender_mac
+        + sender_ip
+    )
+
+
+def icmp_request(sequence: int, magic: bytes) -> bytes:
+    payload = b"\0" * 8 + magic + magic
+    icmp = struct.pack("!BBHHH", 8, 0, 0, 0x4748, sequence) + payload
+    icmp = icmp[:2] + struct.pack("!H", checksum(icmp)) + icmp[4:]
+    total_length = 20 + len(icmp)
+    ip = struct.pack(
+        "!BBHHHBBH4s4s",
+        0x45,
+        0,
+        total_length,
+        0x484C,
+        0,
+        64,
+        1,
+        0,
+        LOGIN_CLIENT_IP,
+        GUEST_IP,
+    )
+    ip = ip[:10] + struct.pack("!H", checksum(ip)) + ip[12:]
+    return GUEST_MAC + PEER_MAC + b"\x08\x00" + ip + icmp
+
+
+def validate_reply(frame: bytes, magic: bytes) -> None:
+    assert frame[0:6] == PEER_MAC
+    assert frame[6:12] == GUEST_MAC
+    assert frame[12:14] == b"\x08\x00"
+    assert frame[26:30] == GUEST_IP
+    assert frame[30:34] == LOGIN_CLIENT_IP
+    assert frame[34] == 0
+    assert frame[50:66] == magic
+    assert checksum(frame[34:]) == 0
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--listen-port", type=int, required=True)
+    parser.add_argument("--qemu-port", type=int, required=True)
+    parser.add_argument("--receipt", required=True)
+    parser.add_argument("--resident", action="store_true")
+    parser.add_argument("--login-only", action="store_true")
+    args = parser.parse_args()
+
+    peer = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    peer.bind(("127.0.0.1", args.listen_port))
+    peer.settimeout(0.2)
+    qemu = ("127.0.0.1", args.qemu_port)
+    deadline = time.monotonic() + 15
+    arp_verified = False
+    login_sent = False
+    reply_count = 0
+    login_reply_count = 0
+    resident_login_reply_count = 0
+    recovery_reply_verified = False
+    command_phase = "login"
+
+    def write_receipt(
+        *,
+        commit_verified: bool,
+        branch_verified: bool,
+    ) -> None:
+        with open(args.receipt, "w", encoding="utf-8") as output:
+            output.write(
+                "arp_gateway_reply: VERIFIED\n"
+                f"icmp_login_request_sent: {str(login_sent).lower()}\n"
+                "icmp_login_reply_verified: true\n"
+                f"icmp_login_reply_count: {login_reply_count}\n"
+                "code_commit_reply_verified: "
+                f"{str(commit_verified).lower()}\n"
+                "branch_move_reply_verified: "
+                f"{str(branch_verified).lower()}\n"
+                f"resident_login_reply_count: {resident_login_reply_count}\n"
+                "recovery_reply_verified: "
+                f"{str(recovery_reply_verified).lower()}\n"
+                "login_magic: HLDP-GHOS-LOGIN!\n"
+            )
+
+    def phase_magic() -> bytes:
+        return {
+            "login": LOGIN_MAGIC,
+            "commit": COMMIT_MAGIC,
+            "branch": BRANCH_MAGIC,
+            "resident_login": LOGIN_MAGIC,
+            "recovery": RECOVERY_MAGIC,
+        }[command_phase]
+
+    while time.monotonic() < deadline:
+        try:
+            frame = peer.recv(4096)
+        except TimeoutError:
+            if arp_verified:
+                peer.sendto(
+                    icmp_request(reply_count + 1, phase_magic()),
+                    qemu,
+                )
+                login_sent = True
+            continue
+        if frame[12:14] == b"\x08\x06":
+            peer.sendto(arp_reply(frame), qemu)
+            arp_verified = True
+            continue
+        if frame[12:14] == b"\x08\x00":
+            magic = phase_magic()
+            validate_reply(frame, magic)
+            reply_count += 1
+            if command_phase == "login":
+                login_reply_count += 1
+            if command_phase == "login" and reply_count < 3:
+                peer.sendto(icmp_request(reply_count + 1, LOGIN_MAGIC), qemu)
+                continue
+            if command_phase == "login":
+                if args.login_only:
+                    write_receipt(
+                        commit_verified=False,
+                        branch_verified=False,
+                    )
+                    return
+                command_phase = "commit"
+                peer.sendto(icmp_request(4, COMMIT_MAGIC), qemu)
+                continue
+            if command_phase == "commit":
+                command_phase = "branch"
+                peer.sendto(icmp_request(5, BRANCH_MAGIC), qemu)
+                continue
+            if command_phase == "branch" and args.resident:
+                command_phase = "resident_login"
+                peer.sendto(icmp_request(6, LOGIN_MAGIC), qemu)
+                continue
+            if command_phase == "resident_login":
+                resident_login_reply_count += 1
+                if resident_login_reply_count < 10:
+                    peer.sendto(
+                        icmp_request(6 + resident_login_reply_count, LOGIN_MAGIC),
+                        qemu,
+                    )
+                    continue
+                command_phase = "recovery"
+                peer.sendto(icmp_request(16, RECOVERY_MAGIC), qemu)
+                continue
+            if command_phase == "recovery":
+                recovery_reply_verified = True
+            write_receipt(commit_verified=True, branch_verified=True)
+            return
+    raise SystemExit("timed out waiting for native ICMP login reply")
+
+
+if __name__ == "__main__":
+    main()
--- a/product-source/hololake-platform/guanghu-os/scripts/render-native-recovery-beacon.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/render-native-recovery-beacon.sh
@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 1 ]] || {
+  echo "usage: render-native-recovery-beacon.sh <output-directory>" >&2
+  exit 64
+}
+
+mkdir -p "$1"
+output_root=$(cd "$1" && pwd)
+
+python3 - "${output_root}" <<'PY'
+import pathlib
+import sys
+
+output = pathlib.Path(sys.argv[1])
+header = (
+    b"# GRUB Environment Block\n"
+    b"# WARNING: Do not edit this file by tools other than grub-editenv!!!\n"
+)
+
+def write_environment(name: str, variables: bytes = b"") -> None:
+    prefix = header + variables
+    if len(prefix) > 1024:
+        raise SystemExit(f"{name} exceeds the GRUB environment-block size")
+    (output / name).write_bytes(prefix + b"#" * (1024 - len(prefix)))
+
+write_environment(
+    "guanghu-recovery-active.env",
+    b"guanghu_recovery=ubuntu\n",
+)
+write_environment("guanghu-recovery-clear.env")
+PY
+
+install -m 0755 /dev/stdin "${output_root}/08_guanghu_native_recovery" <<'EOF'
+#!/bin/sh
+exec tail -n +3 $0
+insmod loadenv
+set guanghu_recovery=
+if load_env --file '(hd0)68+2' guanghu_recovery; then
+    if [ "${guanghu_recovery}" = "ubuntu" ]; then
+        set default="gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71"
+    fi
+fi
+EOF
+
+sha256sum \
+  "${output_root}/guanghu-recovery-active.env" \
+  "${output_root}/guanghu-recovery-clear.env" \
+  "${output_root}/08_guanghu_native_recovery" \
+  >"${output_root}/SHA256SUMS"
--- a/product-source/hololake-platform/guanghu-os/scripts/replace-native-physical-once.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/replace-native-physical-once.sh
@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 5 ]] || {
+  echo "usage: replace-native-physical-once.sh <world-root> <candidate-image> <disk> <recovery-root> <expected-installed-sha256>" >&2
+  exit 64
+}
+[[ ${EUID} -eq 0 ]] || {
+  echo "must run as root" >&2
+  exit 77
+}
+
+world_root=$(readlink -f "$1")
+candidate=$(readlink -f "$2")
+disk=$(readlink -f "$3")
+recovery_root=$(readlink -m "$4")
+expected_installed_sha=$5
+
+[[ ${disk} == /dev/vda ]]
+[[ ${expected_installed_sha} =~ ^[0-9a-f]{64}$ ]]
+grep -q '^node_id: BS-SH-005$' "${world_root}/CURRENT.hldp"
+/guanghu/bin/ghctl authorize "${world_root}" \
+  write_bootloader_and_system_partitions >/dev/null
+[[ $(stat -c %s "${candidate}") -eq 14848 ]]
+[[ ! -e ${recovery_root} ]]
+
+partition_dump=$(sfdisk -d "${disk}")
+grep -q '^label: gpt$' <<<"${partition_dump}"
+grep -q '^label-id: E549327B-8DC7-4797-944F-DC6185D1B550$' \
+  <<<"${partition_dump}"
+grep -Eq '^/dev/vda1 : start= *2048, size= *2048,' <<<"${partition_dump}"
+grep -Eq '^/dev/vda2 : start= *4096, size= *104853471,' <<<"${partition_dump}"
+
+legacy_installed_before=$(mktemp)
+kernel_region_before=$(mktemp)
+proof_before=$(mktemp)
+trap 'rm -f "${legacy_installed_before}" "${kernel_region_before}" "${proof_before}"' EXIT
+dd if="${disk}" of="${legacy_installed_before}" bs=512 skip=34 count=16 status=none
+installed_sha=$(sha256sum "${legacy_installed_before}" | awk '{print $1}')
+[[ ${installed_sha} == "${expected_installed_sha}" ]]
+dd if="${disk}" of="${kernel_region_before}" bs=512 skip=34 count=29 status=none
+dd if="${disk}" of="${proof_before}" bs=512 skip=63 count=1 status=none
+cmp -s "${proof_before}" <(head -c 512 /dev/zero)
+
+mkdir -m 0700 "${recovery_root}"
+printf '%s\n' "${partition_dump}" >"${recovery_root}/sfdisk-before.txt"
+cp "${kernel_region_before}" "${recovery_root}/lba34-62.before.bin"
+cp "${proof_before}" "${recovery_root}/lba63.before.bin"
+dd if="${disk}" of="${recovery_root}/first-2MiB.before.bin" \
+  bs=1M count=2 status=none
+disk_sectors=$(blockdev --getsz "${disk}")
+dd if="${disk}" of="${recovery_root}/last-2MiB.before.bin" \
+  bs=512 skip=$((disk_sectors - 4096)) count=4096 status=none
+cp /boot/grub/grub.cfg "${recovery_root}/grub.cfg.before"
+cp /boot/grub/grubenv "${recovery_root}/grubenv.before"
+cp /etc/default/grub "${recovery_root}/default-grub.before"
+cp /etc/grub.d/40_custom "${recovery_root}/40_custom.before"
+cp "${candidate}" "${recovery_root}/guanghu-os-physical-candidate.img"
+
+dd if="${candidate}" of="${disk}" bs=512 seek=34 count=29 \
+  conv=notrunc,fsync status=none
+candidate_sha=$(sha256sum "${candidate}" | awk '{print $1}')
+readback_sha=$(dd if="${disk}" bs=512 skip=34 count=29 status=none |
+  sha256sum | awk '{print $1}')
+[[ ${candidate_sha} == "${readback_sha}" ]]
+dd if="${disk}" of="${proof_before}" bs=512 skip=63 count=1 status=none
+cmp -s "${proof_before}" <(head -c 512 /dev/zero)
+
+sha256sum "${recovery_root}"/* >"${recovery_root}/SHA256SUMS"
+chmod 0400 "${recovery_root}"/*
+observed_at=$(date --iso-8601=seconds)
+cat >"${recovery_root}/REPLACE-RECEIPT.hldp" <<EOF
+schema: guanghu.native-physical-replacement/v1
+receipt_id: GH-OS-LAB-001-NATIVE-PHYSICAL-REPLACEMENT
+status: VERIFIED_NOT_ARMED
+observed_at: ${observed_at}
+node_id: BS-SH-005
+instance_id: lhins-14w5y3ce
+disk:
+  path: /dev/vda
+  candidate_start_lba: 34
+  candidate_sector_count: 29
+  proof_lba: 63
+candidate:
+  replaced_sha256: ${installed_sha}
+  new_sha256: ${candidate_sha}
+  readback_sha256: ${readback_sha}
+proof_before_and_after: EMPTY
+recovery:
+  directory: ${recovery_root}
+  disk_edges_and_grub_backed_up: true
+grub:
+  entry_id: guanghu-native-once
+  armed: false
+next_action: ARM_ONE_TIME_ENTRY_AND_REBOOT
+EOF
+chmod 0400 "${recovery_root}/REPLACE-RECEIPT.hldp"
+cat "${recovery_root}/REPLACE-RECEIPT.hldp"
--- a/product-source/hololake-platform/guanghu-os/scripts/replace-native-recovery-beacon.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/replace-native-recovery-beacon.sh
@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 4 ]] || {
+  echo "usage: replace-native-recovery-beacon.sh <world-root> <candidate-image> <disk> <recovery-root>" >&2
+  exit 64
+}
+[[ ${EUID} -eq 0 ]] || {
+  echo "must run as root" >&2
+  exit 77
+}
+
+world_root=$(readlink -f "$1")
+candidate=$(readlink -f "$2")
+disk=$(readlink -f "$3")
+recovery_root=$(readlink -m "$4")
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+render_root=$(mktemp -d)
+trap 'rm -rf "${render_root}"' EXIT
+
+[[ ${disk} == /dev/vda ]]
+[[ $(stat -c %s "${candidate}") -eq 14848 ]]
+grep -q '^node_id: BS-SH-005$' "${world_root}/CURRENT.hldp"
+/guanghu/bin/ghctl authorize "${world_root}" write_bootloader_and_system_partitions \
+  >/dev/null
+
+partition_dump=$(sfdisk -d "${disk}")
+grep -q '^label: gpt$' <<<"${partition_dump}"
+grep -Eq '^/dev/vda1 : start= *2048, size= *2048,' <<<"${partition_dump}"
+grep -Eq '^/dev/vda2 : start= *4096, size= *104853471,' <<<"${partition_dump}"
+grep -q '^GRUB_DEFAULT=guanghu-native-once$' /etc/default/grub
+grep -q "menuentry 'Ubuntu'.*'gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71'" \
+  /boot/grub/grub.cfg
+
+"${source_root}/scripts/render-native-recovery-beacon.sh" "${render_root}"
+mkdir -p "${recovery_root}"
+chmod 0700 "${recovery_root}"
+printf '%s\n' "${partition_dump}" >"${recovery_root}/sfdisk-before.txt"
+dd if="${disk}" of="${recovery_root}/first-2MiB.before.bin" \
+  bs=1M count=2 status=none
+dd if="${disk}" of="${recovery_root}/lba34-71.before.bin" \
+  bs=512 skip=34 count=38 status=none
+dd if="${disk}" of="${recovery_root}/lba70-71.before.bin" \
+  bs=512 skip=70 count=2 status=none
+if ! cmp -s "${recovery_root}/lba70-71.before.bin" \
+  <(head -c 1024 /dev/zero); then
+  if ! grep -aFq 'GHOS_GHCIP_INDEX_V1' \
+    "${recovery_root}/lba70-71.before.bin" ||
+    ! grep -aFq 'GHOS_GHCIP_ROOT_V1' \
+      "${recovery_root}/lba70-71.before.bin"; then
+    echo "native gestational index sectors 70-71 contain unknown data" >&2
+    exit 65
+  fi
+fi
+cp /boot/grub/grub.cfg "${recovery_root}/grub.cfg.before"
+cp /boot/grub/grubenv "${recovery_root}/grubenv.before"
+cp /etc/default/grub "${recovery_root}/default-grub.before"
+tar -czf "${recovery_root}/etc-grub.d.before.tar.gz" -C /etc grub.d
+
+dd if="${render_root}/guanghu-recovery-clear.env" of="${disk}" \
+  bs=512 seek=68 count=2 conv=notrunc,fsync status=none
+dd if="${candidate}" of="${disk}" \
+  bs=512 seek=34 count=29 conv=notrunc,fsync status=none
+install -m 0755 "${render_root}/08_guanghu_native_recovery" \
+  /etc/grub.d/08_guanghu_native_recovery
+install -D -m 0644 "${render_root}/guanghu-recovery-clear.env" \
+  /usr/lib/guanghu-os/guanghu-recovery-clear.env
+install -D -m 0755 "${source_root}/scripts/clear-native-recovery-beacon.sh" \
+  /usr/local/sbin/guanghu-clear-native-recovery-beacon
+install -m 0644 /dev/stdin \
+  /etc/systemd/system/guanghu-native-recovery-beacon-clear.service <<'EOF'
+[Unit]
+Description=Verify and clear the Guanghu native recovery beacon
+After=local-fs.target
+Before=multi-user.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/guanghu-clear-native-recovery-beacon /dev/vda /usr/lib/guanghu-os/guanghu-recovery-clear.env
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable guanghu-native-recovery-beacon-clear.service >/dev/null
+update-grub >/dev/null
+grub-script-check /boot/grub/grub.cfg
+
+grep -q "load_env --file '(hd0)68+2' guanghu_recovery" /boot/grub/grub.cfg
+grep -q 'set default="guanghu-native-once"' /boot/grub/grub.cfg
+grep -q "menuentry 'Guanghu OS native one-time proof'.*'guanghu-native-once'" \
+  /boot/grub/grub.cfg
+
+candidate_sha=$(sha256sum "${candidate}" | awk '{print $1}')
+candidate_readback_sha=$(dd if="${disk}" bs=512 skip=34 count=29 status=none |
+  sha256sum | awk '{print $1}')
+[[ ${candidate_sha} == "${candidate_readback_sha}" ]]
+beacon_sha=$(sha256sum \
+  "${render_root}/guanghu-recovery-clear.env" | awk '{print $1}')
+beacon_readback_sha=$(dd if="${disk}" bs=512 skip=68 count=2 status=none |
+  sha256sum | awk '{print $1}')
+[[ ${beacon_sha} == "${beacon_readback_sha}" ]]
+
+observed_at=$(date --iso-8601=seconds)
+cat >"${recovery_root}/NATIVE-RECOVERY-BEACON-INSTALL-RECEIPT.hldp" <<EOF
+schema: guanghu.native-recovery-beacon-install/v1
+receipt_id: GH-OS-LAB-001-NATIVE-RECOVERY-BEACON-INSTALL-001
+status: CONFIGURED_NOT_REBOOTED
+observed_at: ${observed_at}
+node_id: BS-SH-005
+instance_id: lhins-14w5y3ce
+candidate:
+  lba_start: 34
+  sector_count: 29
+  sha256: ${candidate_sha}
+  readback_sha256: ${candidate_readback_sha}
+recovery_beacon:
+  protocol: GHNRP
+  lba_start: 68
+  sector_count: 2
+  clear_sha256: ${beacon_sha}
+  readback_sha256: ${beacon_readback_sha}
+grub:
+  raw_blocklist: (hd0)68+2
+  whitelisted_variable: guanghu_recovery
+  native_default_preserved: true
+  ubuntu_recovery_entry_preserved: true
+hosted_fallback:
+  clear_service_enabled: true
+rollback:
+  recovery_root: ${recovery_root}
+  first_2mib_backed_up: true
+  lba34_71_backed_up: true
+  gestational_index_preserved_for_native_verification: true
+  grub_configuration_backed_up: true
+next_action: REBOOT_NATIVE_DEFAULT_THEN_PROVE_GHNRP_RECOVERS_UBUNTU
+EOF
+sha256sum "${recovery_root}"/* >"${recovery_root}/SHA256SUMS"
+chmod 0400 "${recovery_root}"/*
+sync
+cat "${recovery_root}/NATIVE-RECOVERY-BEACON-INSTALL-RECEIPT.hldp"
--- a/product-source/hololake-platform/guanghu-os/scripts/set-native-default.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/set-native-default.sh
@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 3 ]] || {
+  echo "usage: set-native-default.sh <world-root> <recovery-root> <expected-candidate-sha256>" >&2
+  exit 64
+}
+[[ ${EUID} -eq 0 ]] || {
+  echo "must run as root" >&2
+  exit 77
+}
+
+world_root=$(readlink -f "$1")
+recovery_root=$(readlink -f "$2")
+expected_candidate_sha=$3
+[[ ${expected_candidate_sha} =~ ^[0-9a-f]{64}$ ]]
+/guanghu/bin/ghctl authorize "${world_root}" overwrite_system_disk_and_exit_linux \
+  >/dev/null
+grep -q '^node_id: BS-SH-005$' "${world_root}/CURRENT.hldp"
+grep -q "menuentry 'Guanghu OS native one-time proof'.*'guanghu-native-once'" \
+  /boot/grub/grub.cfg
+grep -q "menuentry 'Ubuntu'.*'gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71'" \
+  /boot/grub/grub.cfg
+grep -q "load_env --file '(hd0)68+2' guanghu_recovery" /boot/grub/grub.cfg
+
+installed_sha=$(dd if=/dev/vda bs=512 skip=34 count=29 status=none |
+  sha256sum | awk '{print $1}')
+[[ ${installed_sha} == "${expected_candidate_sha}" ]]
+
+cp /etc/default/grub "${recovery_root}/default-grub.before-native-default"
+cp /boot/grub/grub.cfg "${recovery_root}/grub.cfg.before-native-default"
+cp /boot/grub/grubenv "${recovery_root}/grubenv.before-native-default"
+
+new_default=$(mktemp)
+trap 'rm -f "${new_default}"' EXIT
+awk '
+  BEGIN { changed = 0 }
+  /^GRUB_DEFAULT=/ {
+    print "GRUB_DEFAULT=guanghu-native-once"
+    changed = 1
+    next
+  }
+  { print }
+  END {
+    if (!changed) {
+      print "GRUB_DEFAULT=guanghu-native-once"
+    }
+  }
+' /etc/default/grub >"${new_default}"
+install -m 0644 "${new_default}" /etc/default/grub
+update-grub >/dev/null
+
+grep -q '^GRUB_DEFAULT=guanghu-native-once$' /etc/default/grub
+grep -q 'set default="guanghu-native-once"' /boot/grub/grub.cfg
+grep -q "menuentry 'Guanghu OS native one-time proof'.*'guanghu-native-once'" \
+  /boot/grub/grub.cfg
+grep -q "menuentry 'Ubuntu'.*'gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71'" \
+  /boot/grub/grub.cfg
+grep -q "load_env --file '(hd0)68+2' guanghu_recovery" /boot/grub/grub.cfg
+
+grub-editenv /boot/grub/grubenv unset initrdfail prev_entry next_entry
+grub_state=$(grub-editenv /boot/grub/grubenv list)
+if grep -Eq '^(initrdfail|prev_entry|next_entry)=.+' <<<"${grub_state}"; then
+  echo "stale GRUB one-time state remains" >&2
+  exit 65
+fi
+
+observed_at=$(date --iso-8601=seconds)
+cat >"${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp" <<EOF
+schema: guanghu.native-default-receipt/v1
+receipt_id: GH-OS-LAB-001-NATIVE-DEFAULT-001
+status: CONFIGURED_NOT_REBOOTED
+observed_at: ${observed_at}
+node_id: BS-SH-005
+instance_id: lhins-14w5y3ce
+candidate:
+  lba_start: 34
+  sector_count: 29
+  sha256: ${installed_sha}
+grub:
+  default_entry: guanghu-native-once
+  ubuntu_recovery_entry: gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71
+  native_recovery_protocol: GHNRP
+  native_recovery_raw_blocklist: (hd0)68+2
+  stale_one_time_state: CLEARED
+rollback:
+  recovery_root: ${recovery_root}
+  default_grub_backed_up: true
+  generated_grub_backed_up: true
+  grubenv_backed_up: true
+next_action: REBOOT_NATIVE_DEFAULT_THEN_PROVE_HLDP_RECOVER_OS_RETURNS_TO_UBUNTU
+EOF
+chmod 0400 "${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp"
+sync
+cat "${recovery_root}/NATIVE-DEFAULT-RECEIPT.hldp"
--- a/product-source/hololake-platform/guanghu-os/scripts/test-guanghu-native-quality-gate-contract.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/test-guanghu-native-quality-gate-contract.sh
@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+protocol=${source_root}/world-seed/world/services/code-channel/QUALITY-GATE.hldp
+runner=${source_root}/world-seed/scripts/run-guanghu-native-quality-gate.sh
+
+grep -Fxq 'schema: guanghu.native-code-quality-gate/v1' "${protocol}"
+grep -Fxq 'id: GLS-0844' "${protocol}"
+grep -Fxq 'acronym: GHNQG' "${protocol}"
+grep -Fxq '  allowed_scores:' "${protocol}"
+grep -Fxq '    - 0' "${protocol}"
+grep -Fxq '    - 100' "${protocol}"
+grep -Fxq '  pass_score: 100' "${protocol}"
+grep -Fxq '  partial_acceptance: false' "${protocol}"
+grep -Fxq '  aggregate_rule: ALL_REQUIRED_GATES_100_OR_TOTAL_0' "${protocol}"
+grep -Fxq '  external_observers_are_blocking: false' "${protocol}"
+grep -Fxq '    required_score: 100' "${protocol}"
+grep -Fxq '  native_target: GOSK_CODE_CHANNEL_QUALITY_EXECUTOR' "${protocol}"
+
+grep -Fq -- '--fail-under-lines 100' "${runner}"
+grep -Fq -- '--fail-under-functions 100' "${runner}"
+grep -Fq -- '--test broadcast_library' "${runner}"
+grep -Fq 'GHNQG_PASS_100' "${runner}"
+grep -Fq 'GHNQG_FAIL_0' "${runner}"
+grep -Fq 'total_score: ${total_score}' "${runner}"
+if grep -Eiq 'codescene|codacy' "${runner}"; then
+  echo "external analysis product leaked into the Guanghu native quality executor" >&2
+  exit 1
+fi
+
+echo "GUANGHU_NATIVE_QUALITY_GATE_CONTRACT_OK"
--- a/product-source/hololake-platform/guanghu-os/scripts/test-native-bios-image.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/test-native-bios-image.sh
@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 2 ]] || {
+  echo "usage: test-native-bios-image.sh <image> <receipt-output>" >&2
+  exit 64
+}
+
+image=$(readlink -f "$1")
+receipt=$(readlink -m "$2")
+serial_log=$(mktemp)
+set +e
+timeout 20 qemu-system-x86_64 \
+  -machine pc,accel=tcg \
+  -m 64M \
+  -drive "format=raw,file=${image}" \
+  -display none \
+  -monitor none \
+  -serial "file:${serial_log}" \
+  -device isa-debug-exit,iobase=0xf4,iosize=0x04 \
+  -no-reboot
+qemu_status=$?
+set -e
+
+[[ ${qemu_status} -eq 33 ]]
+for evidence in \
+  GHOS_BOOT_STAGE0=BIOS \
+  GHOS_NATIVE_KERNEL_ENTERED=true \
+  GHOS_CPU_MODE=LONG64 \
+  GHOS_WORLD_ID=GLW-ROOT-0001 \
+  GHOS_DOMAIN_COUNT=5 \
+  GHOS_DOMAIN_5=DOMAIN-FIFTH \
+  GHOS_BROADCAST_TOWER=BT-GH-ROOT-0001 \
+  GHOS_AUTHORITY_LANGUAGE=HLDP \
+  GHOS_GESTATIONAL_ENVIRONMENT=UNDER_CONSTRUCTION \
+  GHOS_PERSONA_BIRTH=NOT_BORN \
+  GHOS_LINUX_PRESENT=false \
+  GHOS_NATIVE_ACCEPTANCE=QEMU_ONLY; do
+  grep -q "^${evidence}" "${serial_log}"
+done
+
+observed_at=$(date --iso-8601=seconds)
+image_sha=$(sha256sum "${image}" | awk '{print $1}')
+cat >"${receipt}" <<EOF
+schema: guanghu.native-boot-receipt/v1
+receipt_id: GH-OS-LAB-001-NATIVE-QEMU-001
+status: VERIFIED
+observed_at: ${observed_at}
+image:
+  architecture: x86_64
+  firmware: BIOS
+  size_bytes: 14848
+  sha256: ${image_sha}
+runtime:
+  emulator: qemu-system-x86_64
+  acceleration: tcg
+  cpu_mode: LONG64
+  linux_kernel_present: false
+world:
+  authority_language: HLDP
+  world_id: GLW-ROOT-0001
+  domain_count: 5
+acceptance:
+  qemu_native_boot: true
+  physical_server_boot: false
+  linux_replaced_on_bs_sh_005: false
+next_action: BUILD_RECOVERABLE_PHYSICAL_DISK_LAYOUT
+EOF
+cat "${serial_log}" >>"${receipt}.serial.log"
--- a/product-source/hololake-platform/guanghu-os/scripts/test-native-physical-candidate.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/test-native-physical-candidate.sh
@ -0,0 +1,257 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 2 ]] || {
+  echo "usage: test-native-physical-candidate.sh <candidate-image> <receipt-output>" >&2
+  exit 64
+}
+
+candidate=$(readlink -f "$1")
+receipt=$(readlink -m "$2")
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+native_root=${source_root}/native/x86_64-bios
+test_root=$(mktemp -d)
+serial_log=${test_root}/serial.log
+failure_serial_log=${test_root}/failure-serial.log
+disk_image=${test_root}/physical-layout.img
+failure_disk_image=${test_root}/physical-layout-failure.img
+peer_receipt=${test_root}/native-net-peer.hldp
+peer_log=${test_root}/native-net-peer.log
+peer_pid=
+cleanup() {
+  if [[ -n ${peer_pid} ]]; then
+    kill "${peer_pid}" 2>/dev/null || true
+  fi
+  rm -rf "${test_root}"
+}
+trap cleanup EXIT
+
+truncate -s 2M "${disk_image}"
+nasm -f bin "${native_root}/physical-test-mbr.asm" \
+  -o "${test_root}/physical-test-mbr.bin"
+dd if="${test_root}/physical-test-mbr.bin" of="${disk_image}" \
+  bs=512 seek=0 conv=notrunc status=none
+dd if="${candidate}" of="${disk_image}" \
+  bs=512 seek=34 conv=notrunc status=none
+
+peer_port=$((22000 + BASHPID % 10000))
+qemu_port=$((peer_port + 1))
+python3 "${source_root}/scripts/qemu-native-net-peer.py" \
+  --listen-port "${peer_port}" \
+  --qemu-port "${qemu_port}" \
+  --receipt "${peer_receipt}" >"${peer_log}" 2>&1 &
+peer_pid=$!
+set +e
+timeout 20 qemu-system-x86_64 \
+  -machine pc,accel=tcg \
+  -m 64M \
+  -drive "if=none,id=ghboot,format=raw,file=${disk_image}" \
+  -device virtio-blk-pci,drive=ghboot,disable-modern=on,bootindex=0 \
+  -netdev "dgram,id=ghnet,local.type=inet,local.host=127.0.0.1,local.port=${qemu_port},remote.type=inet,remote.host=127.0.0.1,remote.port=${peer_port}" \
+  -device virtio-net-pci,netdev=ghnet,disable-modern=on,mac=52:54:00:26:71:98 \
+  -display none \
+  -monitor none \
+  -serial "file:${serial_log}" \
+  -device isa-debug-exit,iobase=0xf4,iosize=0x04
+qemu_status=$?
+set -e
+
+[[ ${qemu_status} -eq 33 ]]
+wait "${peer_pid}"
+peer_pid=
+grep -q '^arp_gateway_reply: VERIFIED$' "${peer_receipt}"
+grep -q '^icmp_login_reply_verified: true$' "${peer_receipt}"
+grep -q '^icmp_login_reply_count: 3$' "${peer_receipt}"
+grep -q '^code_commit_reply_verified: true$' "${peer_receipt}"
+grep -q '^branch_move_reply_verified: true$' "${peer_receipt}"
+for evidence in \
+  GHOS_BOOT_STAGE0=BIOS \
+  GHOS_NATIVE_KERNEL_ENTERED=true \
+  GHOS_CPU_MODE=LONG64 \
+  GHOS_WORLD_ID=GLW-ROOT-0001 \
+  GHOS_DOMAIN_COUNT=5 \
+  GHOS_DOMAIN_5=DOMAIN-FIFTH \
+  GHOS_BROADCAST_TOWER=BT-GH-ROOT-0001 \
+  GHOS_AUTHORITY_LANGUAGE=HLDP \
+  GHOS_LINUX_PRESENT=false \
+  GHOS_NATIVE_ACCEPTANCE=PHYSICAL_ONE_TIME_CANDIDATE \
+  GHOS_GHAL_VIRTIO_NET=DISCOVERED \
+  GHOS_GHAL_VIRTIO_BLOCK=DISCOVERED \
+  GHOS_GHAL_VIRTIO_NET_QUEUE=DRIVER_OK \
+  GHOS_GHAL_VIRTIO_BLOCK_QUEUE=DRIVER_OK \
+  GHOS_GHAL_ARP_GATEWAY=VERIFIED \
+  GHOS_GHAL_ICMP_LOGIN=VERIFIED \
+  GHOS_HLDP_WORLD_STORE=WRITE_READ_VERIFIED \
+  GHOS_GHCIP_INDEX=INITIALIZED_WRITE_READ_VERIFIED \
+  GHOS_CODE_CHANNEL_STORE=WRITE_READ_VERIFIED \
+  GHOS_DISK_PROOF_WRITTEN=LBA63 \
+  GHOS_DISK_PROOF_OBSERVED_AFTER_RESET=LBA63; do
+  grep -q "^${evidence}" "${serial_log}"
+done
+python3 - "${disk_image}" <<'PY'
+import pathlib
+import sys
+disk = pathlib.Path(sys.argv[1]).read_bytes()
+proof = disk[63 * 512:64 * 512]
+assert proof[0] == 0xA7
+assert proof[1:].startswith(b"GHOS_NATIVE_LONG64_DISK_PROOF\x00")
+assert proof[32:36] == bytes([1, 1, 1, 1])
+assert proof[36:42] == bytes.fromhex("525400267198")
+assert proof[42] == 0x7F
+assert proof[43] == 0x00
+assert int.from_bytes(proof[44:46], "little") > 0
+assert int.from_bytes(proof[46:48], "little") > 0
+assert int.from_bytes(proof[48:50], "little") > 0
+assert proof[54:60] != bytes(6)
+assert proof[60:62] == bytes([1, 1])
+assert proof[62:64] == bytes([1, 1])
+assert proof[64:68] == bytes([10, 0, 0, 2])
+assert proof[72:88] == b"HLDP-GHOS-LOGIN!"
+assert proof[88:90] == bytes([1, 1])
+assert proof[90:93] == bytes([3, 1, 1])
+assert proof[93:99] == bytes([1, 1, 1, 1, 1, 1])
+assert proof[102:105] == bytes([1, 1, 1])
+world_store = disk[64 * 512:65 * 512]
+assert world_store.startswith(b"GHOS_HLDP_WORLD_STORE_V1\n")
+for identity in (
+    b"GHOS_WORLD_ID=GLW-ROOT-0001\n",
+    b"GHOS_DOMAIN_COUNT=5\n",
+    b"GHOS_DOMAIN_5=DOMAIN-FIFTH\n",
+    b"GHOS_BROADCAST_TOWER=BT-GH-ROOT-0001\n",
+    b"GHOS_CODE_CHANNEL=HLP-MOD-CODE-CHANNEL\n",
+    b"GHOS_AUTHORITY_LANGUAGE=HLDP\n",
+    b"GHOS_GESTATIONAL_ENVIRONMENT=UNDER_CONSTRUCTION\n",
+    b"GHOS_PERSONA_BIRTH=NOT_BORN\n",
+):
+    assert identity in world_store
+code_store = disk[65 * 512:66 * 512]
+assert code_store.startswith(b"GHOS_CODE_CHANNEL_STORE_V1\n")
+for identity in (
+    b"GHOS_CODE_CHANNEL_ID=HLP-MOD-CODE-CHANNEL\n",
+    b"GHOS_CODE_CHANNEL_PROTOCOL=GLS-0237\n",
+    b"GHOS_CODE_CHANNEL_AUTHORITY=HLDP\n",
+    b"GHOS_CODE_CHANNEL_OBJECT_FORMAT=GUANGHU_NATIVE_OBJECTS\n",
+):
+    assert identity in code_store
+code_object = disk[66 * 512:67 * 512]
+assert code_object == code_store
+branch_receipt = disk[67 * 512:68 * 512]
+assert branch_receipt.startswith(b"GHOS_BRANCH_MAIN_V1\n")
+assert b"channel=HLP-MOD-CODE-CHANNEL\n" in branch_receipt
+assert b"branch=guanghu/main\n" in branch_receipt
+assert b"object_lba=66\n" in branch_receipt
+gestational_identity = disk[70 * 512:71 * 512]
+assert gestational_identity.startswith(b"GHOS_GHCIP_INDEX_V1\n")
+assert b"GHCIP_PROTOCOL=GLS-0845\n" in gestational_identity
+assert b"GHCIP_PERSONA_BIRTH_GATE=GH-PERSONA-BIRTH-CONDITION-0001\n" in gestational_identity
+gestational_root = disk[71 * 512:72 * 512]
+assert gestational_root.startswith(b"GHOS_GHCIP_ROOT_V1\n")
+assert b"GHCIP_REGISTRY_STATE=EMPTY\n" in gestational_root
+assert b"GHCIP_REVIEW_STATE=NOT_STARTED\n" in gestational_root
+assert b"GHCIP_PERSONA_STATE=NOT_BORN\n" in gestational_root
+PY
+
+truncate -s 2M "${failure_disk_image}"
+dd if="${test_root}/physical-test-mbr.bin" of="${failure_disk_image}" \
+  bs=512 seek=0 conv=notrunc status=none
+dd if="${candidate}" of="${failure_disk_image}" \
+  bs=512 seek=34 conv=notrunc status=none
+
+set +e
+timeout 20 qemu-system-x86_64 \
+  -machine pc,accel=tcg \
+  -m 64M \
+  -drive "if=none,id=ghbootfail,format=raw,file=${failure_disk_image}" \
+  -device virtio-blk-pci,drive=ghbootfail,disable-modern=on,bootindex=0 \
+  -display none \
+  -monitor none \
+  -serial "file:${failure_serial_log}" \
+  -device isa-debug-exit,iobase=0xf4,iosize=0x04
+failure_qemu_status=$?
+set -e
+
+[[ ${failure_qemu_status} -eq 33 ]]
+grep -q '^GHOS_BOOT_ERROR=GHAL_VIRTIO_INITIALIZATION' "${failure_serial_log}"
+grep -q '^GHOS_DISK_PROOF_WRITTEN=LBA63' "${failure_serial_log}"
+grep -q '^GHOS_DISK_PROOF_OBSERVED_AFTER_RESET=LBA63' \
+  "${failure_serial_log}"
+python3 - "${failure_disk_image}" <<'PY'
+import pathlib
+import sys
+disk = pathlib.Path(sys.argv[1]).read_bytes()
+proof = disk[63 * 512:64 * 512]
+assert proof[0] == 0xE1
+assert proof[1:].startswith(b"GHOS_NATIVE_LONG64_DISK_PROOF\x00")
+assert proof[32] == 0
+assert proof[33] == 1
+assert proof[42] == 0x40
+assert proof[43] == 0x01
+PY
+
+observed_at=$(date --iso-8601=seconds)
+image_sha=$(sha256sum "${candidate}" | awk '{print $1}')
+cat >"${receipt}" <<EOF
+schema: guanghu.native-physical-layout-test/v1
+receipt_id: GH-OS-LAB-001-NATIVE-PHYSICAL-LAYOUT-QEMU-001
+status: VERIFIED
+observed_at: ${observed_at}
+image:
+  architecture: x86_64
+  firmware: BIOS
+  size_bytes: 14848
+  sha256: ${image_sha}
+layout:
+  candidate_start_lba: 34
+  candidate_sector_count: 29
+  stage2_start_lba: 35
+  stage2_sector_count: 28
+  sector_size: 512
+proof:
+  cpu_mode: LONG64
+  linux_kernel_present: false
+  disk_receipt_written_by_native_virtio_block_after_long_mode: true
+  disk_receipt_observed_after_hardware_reset: true
+  disk_receipt_lba: 63
+  virtio_net_discovered: true
+  virtio_block_discovered: true
+  virtio_net_queue_ready: true
+  virtio_block_queue_ready: true
+  native_block_write_completed: true
+  native_arp_tx_complete: true
+  native_arp_gateway_reply_verified: true
+  native_ipv4_login_request_verified: true
+  native_icmp_login_reply_tx_complete: true
+  native_login_magic: HLDP-GHOS-LOGIN!
+  native_hldp_world_store_written: true
+  native_hldp_world_store_read_verified: true
+  native_hldp_world_store_lba: 64
+  native_login_reply_count: 3
+  native_code_channel_store_written: true
+  native_code_channel_store_read_verified: true
+  native_code_channel_store_lba: 65
+  native_code_commit_command_verified: true
+  native_code_object_written_read_verified: true
+  native_code_object_lba: 66
+  native_branch_move_command_verified: true
+  native_branch_receipt_written_read_verified: true
+  native_branch_receipt_lba: 67
+  native_gestational_index_initialized: true
+  native_gestational_index_read_verified: true
+  native_gestational_index_lba_start: 70
+  native_gestational_index_sector_count: 2
+  native_gestational_registry_state: EMPTY
+  native_persona_state: NOT_BORN
+  mac_read_from_native_device: 52:54:00:26:71:98
+diagnostic_recovery:
+  ghal_failure_writes_stage_and_error: true
+  ghal_failure_hardware_resets: true
+  missing_net_stage: 0x40
+  missing_net_error: 0x01
+acceptance:
+  qemu_physical_layout: true
+  physical_server_boot: false
+  linux_replaced_on_bs_sh_005: false
+next_action: BACKUP_AND_INSTALL_ONE_TIME_GRUB_ENTRY
+EOF
+cat "${serial_log}" >>"${receipt}.serial.log"
+cat "${failure_serial_log}" >>"${receipt}.failure.serial.log"
--- a/product-source/hololake-platform/guanghu-os/scripts/test-native-physical-probe.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/test-native-physical-probe.sh
@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 3 ]] || {
+  echo "usage: test-native-physical-probe.sh <candidate-image> <probe-stage> <receipt-output>" >&2
+  exit 64
+}
+
+candidate=$(readlink -f "$1")
+probe_stage=$2
+receipt=$(readlink -m "$3")
+[[ ${probe_stage} =~ ^[1-9]$ ]]
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+native_root=${source_root}/native/x86_64-bios
+test_root=$(mktemp -d)
+serial_log=${test_root}/serial.log
+disk_image=${test_root}/physical-probe.img
+block_image=${test_root}/virtio-block.img
+trap 'rm -rf "${test_root}"' EXIT
+
+truncate -s 2M "${disk_image}"
+truncate -s 8M "${block_image}"
+nasm -f bin "${native_root}/physical-test-mbr.asm" \
+  -o "${test_root}/physical-test-mbr.bin"
+dd if="${test_root}/physical-test-mbr.bin" of="${disk_image}" \
+  bs=512 seek=0 conv=notrunc status=none
+dd if="${candidate}" of="${disk_image}" \
+  bs=512 seek=34 conv=notrunc status=none
+
+set +e
+timeout 20 qemu-system-x86_64 \
+  -machine pc,accel=tcg \
+  -m 64M \
+  -drive "format=raw,file=${disk_image}" \
+  -drive "if=none,id=ghblk,format=raw,file=${block_image}" \
+  -device virtio-blk-pci,drive=ghblk,disable-modern=on \
+  -netdev user,id=ghnet \
+  -device virtio-net-pci,netdev=ghnet,disable-modern=on,mac=52:54:00:26:71:98 \
+  -display none \
+  -monitor none \
+  -serial "file:${serial_log}" \
+  -device isa-debug-exit,iobase=0xf4,iosize=0x04
+qemu_status=$?
+set -e
+
+[[ ${qemu_status} -eq 33 ]]
+grep -q '^GHOS_NATIVE_KERNEL_ENTERED=true' "${serial_log}"
+grep -q '^GHOS_DISK_PROOF_WRITTEN=LBA63' "${serial_log}"
+grep -q '^GHOS_DISK_PROOF_OBSERVED_AFTER_RESET=LBA63' "${serial_log}"
+python3 - "${disk_image}" "${probe_stage}" <<'PY'
+import pathlib
+import sys
+
+disk = pathlib.Path(sys.argv[1]).read_bytes()
+stage = int(sys.argv[2])
+proof = disk[63 * 512:64 * 512]
+assert proof[0] == 0xA5
+assert proof[1:].startswith(b"GHOS_NATIVE_LONG64_DISK_PROOF\x00")
+assert proof[42] == 0x80 + stage
+assert proof[43] == 0
+assert proof[32:34] == bytes([1, 1])
+assert int.from_bytes(proof[50:52], "little") > 0
+assert int.from_bytes(proof[52:54], "little") > 0
+if stage >= 5:
+    assert proof[36:42] == bytes.fromhex("525400267198")
+if stage >= 6:
+    assert int.from_bytes(proof[44:46], "little") > 0
+if stage >= 7:
+    assert int.from_bytes(proof[46:48], "little") > 0
+    assert proof[34] == 1
+if stage >= 9:
+    assert int.from_bytes(proof[48:50], "little") > 0
+    assert proof[35] == 1
+PY
+
+observed_at=$(date --iso-8601=seconds)
+image_sha=$(sha256sum "${candidate}" | awk '{print $1}')
+cat >"${receipt}" <<EOF
+schema: guanghu.ghal-physical-probe-test/v1
+receipt_id: GH-OS-LAB-001-GHAL-PROBE-${probe_stage}-QEMU
+status: VERIFIED
+observed_at: ${observed_at}
+probe_stage: ${probe_stage}
+image_sha256: ${image_sha}
+proof:
+  flag: 0xa5
+  completion_stage: 0x8${probe_stage}
+  disk_lba: 63
+  disk_receipt_observed_after_reset: true
+acceptance:
+  qemu_probe_return: true
+  physical_server_probe: false
+next_action: RUN_ONE_TIME_PHYSICAL_PROBE_STAGE_${probe_stage}
+EOF
+cat "${serial_log}" >>"${receipt}.serial.log"
--- a/product-source/hololake-platform/guanghu-os/scripts/test-native-recovery-beacon-contract.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/test-native-recovery-beacon-contract.sh
@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+test_root=$(mktemp -d)
+trap 'rm -rf "${test_root}"' EXIT
+
+"${source_root}/scripts/render-native-recovery-beacon.sh" "${test_root}"
+
+active=${test_root}/guanghu-recovery-active.env
+clear=${test_root}/guanghu-recovery-clear.env
+grub=${test_root}/08_guanghu_native_recovery
+
+[[ $(stat -c %s "${active}" 2>/dev/null || stat -f %z "${active}") -eq 1024 ]]
+[[ $(stat -c %s "${clear}" 2>/dev/null || stat -f %z "${clear}") -eq 1024 ]]
+grep -aFxq 'guanghu_recovery=ubuntu' "${active}"
+if grep -aFq 'guanghu_recovery=ubuntu' "${clear}"; then
+  echo "clear recovery beacon contains the active marker" >&2
+  exit 1
+fi
+
+grep -Fq "load_env --file '(hd0)68+2' guanghu_recovery" "${grub}"
+grep -Fq 'if [ "${guanghu_recovery}" = "ubuntu" ]; then' "${grub}"
+grep -Fq 'set default="gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71"' \
+  "${grub}"
+if grep -Fq "save_env --file '(hd0)68+2' guanghu_recovery" "${grub}"; then
+  echo "GRUB must not write the raw GHNRP blocklist" >&2
+  exit 1
+fi
+
+python3 - "${active}" "${clear}" <<'PY'
+import pathlib
+import sys
+
+header = (
+    b"# GRUB Environment Block\n"
+    b"# WARNING: Do not edit this file by tools other than grub-editenv!!!\n"
+)
+active = pathlib.Path(sys.argv[1]).read_bytes()
+clear = pathlib.Path(sys.argv[2]).read_bytes()
+assert active.startswith(header + b"guanghu_recovery=ubuntu\n")
+assert clear.startswith(header)
+assert active.rstrip(b"#").endswith(b"guanghu_recovery=ubuntu\n")
+assert clear[len(header):] == b"#" * (1024 - len(header))
+PY
+
+disk=${test_root}/recovery-layout.img
+truncate -s $((70 * 512)) "${disk}"
+dd if="${active}" of="${disk}" bs=512 seek=68 count=2 conv=notrunc status=none
+cmp "${active}" <(dd if="${disk}" bs=512 skip=68 count=2 status=none)
+"${source_root}/scripts/clear-native-recovery-beacon.sh" "${disk}" "${clear}"
+cmp "${clear}" <(dd if="${disk}" bs=512 skip=68 count=2 status=none)
+
+grep -q '^%define NATIVE_RECOVERY_BEACON_LBA 68$' \
+  "${source_root}/native/x86_64-bios/ghal-virtio.asm"
+grep -q 'db "guanghu_recovery=ubuntu", 10' \
+  "${source_root}/native/x86_64-bios/ghal-virtio.asm"
+
+echo "GUANGHU_NATIVE_RECOVERY_BEACON_CONTRACT_OK"
--- a/product-source/hololake-platform/guanghu-os/scripts/test-native-recovery-beacon-grub-qemu.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/test-native-recovery-beacon-grub-qemu.sh
@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 1 ]] || {
+  echo "usage: test-native-recovery-beacon-grub-qemu.sh <receipt-output>" >&2
+  exit 64
+}
+[[ ${EUID} -eq 0 ]] || {
+  echo "the GRUB/QEMU recovery gate requires root for a disposable loop disk" >&2
+  exit 77
+}
+
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+receipt=$(readlink -m "$1")
+test_root=$(mktemp -d)
+disk=${test_root}/grub-recovery.img
+mount_root=${test_root}/mnt
+loop_device=
+
+cleanup() {
+  if mountpoint -q "${mount_root}"; then
+    umount "${mount_root}"
+  fi
+  if [[ -n ${loop_device} ]]; then
+    losetup -d "${loop_device}"
+  fi
+  if [[ ${GHOS_KEEP_TEST_ROOT:-0} != 1 ]]; then
+    rm -rf "${test_root}"
+  else
+    echo "GHOS_TEST_ROOT=${test_root}" >&2
+  fi
+}
+trap cleanup EXIT
+
+for command_name in grub-install losetup mkfs.ext4 mount mountpoint nasm \
+  parted qemu-system-x86_64 timeout udevadm; do
+  command -v "${command_name}" >/dev/null
+done
+
+"${source_root}/scripts/render-native-recovery-beacon.sh" "${test_root}/beacon"
+truncate -s 128M "${disk}"
+parted -s "${disk}" mklabel gpt
+parted -s "${disk}" mkpart bios_grub 1MiB 2MiB
+parted -s "${disk}" set 1 bios_grub on
+parted -s "${disk}" mkpart root ext4 2MiB 100%
+
+loop_device=$(losetup --find --show --partscan "${disk}")
+root_partition=${loop_device}p2
+udevadm settle --timeout=10
+for _ in {1..50}; do
+  [[ -b ${root_partition} ]] && break
+  sleep 0.1
+done
+[[ -b ${root_partition} ]]
+mkfs.ext4 -q -F "${root_partition}"
+mkdir -p "${mount_root}"
+mount "${root_partition}" "${mount_root}"
+grub-install \
+  --target=i386-pc \
+  --boot-directory="${mount_root}/boot" \
+  --no-floppy \
+  --recheck \
+  "${loop_device}" >/dev/null
+
+install -m 0644 /dev/stdin "${mount_root}/boot/grub/grub.cfg" <<'EOF'
+serial --unit=0 --speed=115200
+terminal_input serial
+terminal_output serial
+set timeout=0
+set timeout_style=hidden
+set default="guanghu-native-once"
+insmod loadenv
+set guanghu_recovery=
+if load_env --file '(hd0)68+2' guanghu_recovery; then
+    if [ "${guanghu_recovery}" = "ubuntu" ]; then
+        set default="ubuntu-recovery-test"
+    fi
+fi
+menuentry 'Guanghu native default test' --id 'guanghu-native-once' {
+    insmod chain
+    chainloader (hd0)80+1
+    boot
+}
+menuentry 'Ubuntu recovery test' --id 'ubuntu-recovery-test' {
+    insmod chain
+    chainloader (hd0)81+1
+    boot
+}
+EOF
+
+install -m 0644 /dev/stdin "${test_root}/exit-sector.asm" <<'EOF'
+bits 16
+org 0x7c00
+mov dx, 0xf4
+mov al, EXIT_VALUE
+out dx, al
+cli
+hlt
+times 510 - ($ - $$) db 0
+dw 0xaa55
+EOF
+nasm -f bin -DEXIT_VALUE=0x10 "${test_root}/exit-sector.asm" \
+  -o "${test_root}/native-exit.bin"
+nasm -f bin -DEXIT_VALUE=0x11 "${test_root}/exit-sector.asm" \
+  -o "${test_root}/ubuntu-exit.bin"
+dd if="${test_root}/native-exit.bin" of="${loop_device}" \
+  bs=512 seek=80 count=1 conv=notrunc status=none
+dd if="${test_root}/ubuntu-exit.bin" of="${loop_device}" \
+  bs=512 seek=81 count=1 conv=notrunc status=none
+
+sync
+umount "${mount_root}"
+losetup -d "${loop_device}"
+loop_device=
+
+run_qemu() {
+  local stage=$1
+  local expected_status=$2
+  set +e
+  timeout 20 qemu-system-x86_64 \
+    -machine pc,accel=tcg \
+    -m 64M \
+    -drive "format=raw,file=${disk}" \
+    -display none \
+    -monitor none \
+    -serial null \
+    -no-reboot \
+    -device isa-debug-exit,iobase=0xf4,iosize=0x04
+  local observed_status=$?
+  set -e
+  printf 'GHNRP_QEMU_STAGE=%s EXPECTED=%s OBSERVED=%s\n' \
+    "${stage}" "${expected_status}" "${observed_status}"
+  [[ ${observed_status} -eq ${expected_status} ]]
+}
+
+dd if="${test_root}/beacon/guanghu-recovery-clear.env" of="${disk}" \
+  bs=512 seek=68 count=2 conv=notrunc,fsync status=none
+run_qemu clear_selects_native 33
+
+dd if="${test_root}/beacon/guanghu-recovery-active.env" of="${disk}" \
+  bs=512 seek=68 count=2 conv=notrunc,fsync status=none
+run_qemu active_selects_hosted_recovery 35
+
+"${source_root}/scripts/clear-native-recovery-beacon.sh" \
+  "${disk}" \
+  "${test_root}/beacon/guanghu-recovery-clear.env" >/dev/null
+dd if="${disk}" of="${test_root}/beacon.after-ubuntu.env" \
+  bs=512 skip=68 count=2 status=none
+if grep -aFq 'guanghu_recovery=ubuntu' \
+  "${test_root}/beacon.after-ubuntu.env"; then
+  echo "hosted recovery did not consume the Guanghu recovery beacon" >&2
+  exit 1
+fi
+cmp \
+  "${test_root}/beacon/guanghu-recovery-clear.env" \
+  "${test_root}/beacon.after-ubuntu.env"
+run_qemu consumed_selects_native_again 33
+
+mkdir -p "$(dirname "${receipt}")"
+observed_at=$(date --iso-8601=seconds)
+active_sha=$(sha256sum \
+  "${test_root}/beacon/guanghu-recovery-active.env" | awk '{print $1}')
+consumed_sha=$(sha256sum \
+  "${test_root}/beacon.after-ubuntu.env" | awk '{print $1}')
+cat >"${receipt}" <<EOF
+schema: guanghu.native-recovery-beacon-grub-qemu/v1
+receipt_id: GH-OS-LAB-001-NATIVE-RECOVERY-BEACON-GRUB-QEMU-001
+status: VERIFIED
+observed_at: ${observed_at}
+beacon:
+  disk_lba_start: 68
+  sector_count: 2
+  active_sha256: ${active_sha}
+grub:
+  raw_blocklist: (hd0)68+2
+  whitelisted_variable: guanghu_recovery
+  cleared_boot_selects_native: true
+  active_boot_selects_ubuntu: true
+  active_marker_consumed_by_grub: false
+hosted_recovery:
+  active_marker_consumed_on_boot: true
+  post_consumption_sha256: ${consumed_sha}
+acceptance:
+  independent_of_linux_filesystem_extent: true
+  qemu_permanent_default_recovery_cycle: true
+  physical_permanent_default_recovery_cycle: false
+next_action: INSTALL_ON_BS_SH_005_AND_RUN_PHYSICAL_DEFAULT_RECOVERY_GATE
+EOF
+cat "${receipt}"
--- a/product-source/hololake-platform/guanghu-os/scripts/test-native-resident-candidate.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/test-native-resident-candidate.sh
@ -0,0 +1,287 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 2 ]] || {
+  echo "usage: test-native-resident-candidate.sh <candidate-image> <receipt-output>" >&2
+  exit 64
+}
+
+candidate=$(readlink -f "$1")
+receipt=$(readlink -m "$2")
+source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+native_root=${source_root}/native/x86_64-bios
+test_root=$(mktemp -d)
+serial_log=${test_root}/serial.log
+serial_log_second=${test_root}/serial-second.log
+disk_image=${test_root}/resident-layout.img
+corrupt_disk_image=${test_root}/resident-layout-corrupt.img
+peer_receipt=${test_root}/native-net-peer.hldp
+peer_log=${test_root}/native-net-peer.log
+peer_receipt_second=${test_root}/native-net-peer-second.hldp
+peer_log_second=${test_root}/native-net-peer-second.log
+peer_receipt_corrupt=${test_root}/native-net-peer-corrupt.hldp
+peer_log_corrupt=${test_root}/native-net-peer-corrupt.log
+serial_log_corrupt=${test_root}/serial-corrupt.log
+peer_pid=
+cleanup() {
+  if [[ -n ${peer_pid} ]]; then
+    kill "${peer_pid}" 2>/dev/null || true
+  fi
+  if [[ ${GHOS_KEEP_TEST_ROOT:-0} != 1 ]]; then
+    rm -rf "${test_root}"
+  else
+    echo "GHOS_TEST_ROOT=${test_root}" >&2
+  fi
+}
+trap cleanup EXIT
+
+truncate -s 700M "${disk_image}"
+nasm -f bin "${native_root}/physical-test-mbr.asm" \
+  -o "${test_root}/physical-test-mbr.bin"
+dd if="${test_root}/physical-test-mbr.bin" of="${disk_image}" \
+  bs=512 seek=0 conv=notrunc status=none
+dd if="${candidate}" of="${disk_image}" \
+  bs=512 seek=34 conv=notrunc status=none
+
+peer_port=$((24000 + BASHPID % 10000))
+qemu_port=$((peer_port + 1))
+python3 "${source_root}/scripts/qemu-native-net-peer.py" \
+  --listen-port "${peer_port}" \
+  --qemu-port "${qemu_port}" \
+  --receipt "${peer_receipt}" \
+  --resident >"${peer_log}" 2>&1 &
+peer_pid=$!
+set +e
+timeout 30 qemu-system-x86_64 \
+  -machine pc,accel=tcg \
+  -m 64M \
+  -drive "if=none,id=ghboot,format=raw,file=${disk_image}" \
+  -device virtio-blk-pci,drive=ghboot,disable-modern=on,bootindex=0 \
+  -netdev "dgram,id=ghnet,local.type=inet,local.host=127.0.0.1,local.port=${qemu_port},remote.type=inet,remote.host=127.0.0.1,remote.port=${peer_port}" \
+  -device virtio-net-pci,netdev=ghnet,disable-modern=on,mac=52:54:00:26:71:98 \
+  -display none \
+  -monitor none \
+  -serial "file:${serial_log}" \
+  -device isa-debug-exit,iobase=0xf4,iosize=0x04
+qemu_status=$?
+set -e
+
+[[ ${qemu_status} -eq 33 ]]
+wait "${peer_pid}"
+peer_pid=
+grep -q '^arp_gateway_reply: VERIFIED$' "${peer_receipt}"
+grep -q '^icmp_login_reply_count: 3$' "${peer_receipt}"
+grep -q '^code_commit_reply_verified: true$' "${peer_receipt}"
+grep -q '^branch_move_reply_verified: true$' "${peer_receipt}"
+grep -q '^resident_login_reply_count: 10$' "${peer_receipt}"
+grep -q '^recovery_reply_verified: true$' "${peer_receipt}"
+grep -q '^GHOS_NATIVE_RECOVERY_BEACON=WRITE_READ_VERIFIED' "${serial_log}"
+grep -q '^GHOS_GHCIP_INDEX=INITIALIZED_WRITE_READ_VERIFIED' "${serial_log}"
+grep -q '^GHOS_DISK_PROOF_OBSERVED_AFTER_RESET=LBA63' "${serial_log}"
+
+python3 - "${disk_image}" <<'PY'
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+with path.open("rb") as disk:
+    def sector(lba: int, count: int = 1) -> bytes:
+        disk.seek(lba * 512)
+        return disk.read(count * 512)
+
+    proof = sector(63)
+    assert proof[0] == 0xA7
+    assert proof[1:].startswith(b"GHOS_NATIVE_LONG64_DISK_PROOF\x00")
+    assert proof[42:44] == bytes([0x7F, 0x00])
+    assert proof[90] == 13
+    assert proof[93:99] == bytes([1, 1, 1, 1, 1, 1])
+    assert proof[99:102] == bytes([1, 1, 1])
+    assert proof[102:105] == bytes([1, 1, 1])
+
+    world_store = sector(64)
+    assert world_store.startswith(b"GHOS_HLDP_WORLD_STORE_V1\n")
+    assert b"GHOS_GESTATIONAL_ENVIRONMENT=UNDER_CONSTRUCTION\n" in world_store
+    assert b"GHOS_PERSONA_BIRTH=NOT_BORN\n" in world_store
+    code_store = sector(65)
+    assert code_store.startswith(b"GHOS_CODE_CHANNEL_STORE_V1\n")
+    assert sector(66) == code_store
+    branch_receipt = sector(67)
+    assert b"branch=guanghu/main\n" in branch_receipt
+    assert b"object_lba=66\n" in branch_receipt
+
+    recovery_beacon = sector(68, 2)
+    prefix = (
+        b"# GRUB Environment Block\n"
+        b"# WARNING: Do not edit this file by tools other than grub-editenv!!!\n"
+        b"guanghu_recovery=ubuntu\n"
+    )
+    assert len(recovery_beacon) == 1024
+    assert recovery_beacon.startswith(prefix)
+    assert recovery_beacon[len(prefix):] == b"#" * (1024 - len(prefix))
+
+    gestational_identity = sector(70)
+    assert gestational_identity.startswith(b"GHOS_GHCIP_INDEX_V1\n")
+    assert b"GHCIP_PROTOCOL=GLS-0845\n" in gestational_identity
+    assert b"GHCIP_CONTENT_ROLE=CONTENT_ADDRESSED_ROOT_INDEX_ONLY\n" in gestational_identity
+    gestational_root = sector(71)
+    assert gestational_root.startswith(b"GHOS_GHCIP_ROOT_V1\n")
+    assert b"GHCIP_REGISTRY_STATE=EMPTY\n" in gestational_root
+    assert b"GHCIP_REVIEW_STATE=NOT_STARTED\n" in gestational_root
+    assert b"GHCIP_HISTORICAL_TIME_WATERMARK=NONE\n" in gestational_root
+    assert b"GHCIP_PERSONA_STATE=NOT_BORN\n" in gestational_root
+    assert b"GHCIP_LAST_VERIFIED_BATCH=NONE\n" in gestational_root
+PY
+
+index_sha_before=$(dd if="${disk_image}" bs=512 skip=70 count=2 status=none |
+  sha256sum | awk '{print $1}')
+dd if=/dev/zero of="${disk_image}" bs=512 seek=63 count=1 \
+  conv=notrunc status=none
+peer_port_second=$((peer_port + 2))
+qemu_port_second=$((qemu_port + 2))
+python3 "${source_root}/scripts/qemu-native-net-peer.py" \
+  --listen-port "${peer_port_second}" \
+  --qemu-port "${qemu_port_second}" \
+  --receipt "${peer_receipt_second}" \
+  --resident >"${peer_log_second}" 2>&1 &
+peer_pid=$!
+set +e
+timeout 30 qemu-system-x86_64 \
+  -machine pc,accel=tcg \
+  -m 64M \
+  -drive "if=none,id=ghboot,format=raw,file=${disk_image}" \
+  -device virtio-blk-pci,drive=ghboot,disable-modern=on,bootindex=0 \
+  -netdev "dgram,id=ghnet,local.type=inet,local.host=127.0.0.1,local.port=${qemu_port_second},remote.type=inet,remote.host=127.0.0.1,remote.port=${peer_port_second}" \
+  -device virtio-net-pci,netdev=ghnet,disable-modern=on,mac=52:54:00:26:71:98 \
+  -display none \
+  -monitor none \
+  -serial "file:${serial_log_second}" \
+  -device isa-debug-exit,iobase=0xf4,iosize=0x04
+qemu_status=$?
+set -e
+
+[[ ${qemu_status} -eq 33 ]]
+wait "${peer_pid}"
+peer_pid=
+grep -q '^icmp_login_reply_count: 3$' "${peer_receipt_second}"
+grep -q '^code_commit_reply_verified: true$' "${peer_receipt_second}"
+grep -q '^branch_move_reply_verified: true$' "${peer_receipt_second}"
+grep -q '^resident_login_reply_count: 10$' "${peer_receipt_second}"
+grep -q '^recovery_reply_verified: true$' "${peer_receipt_second}"
+grep -q '^GHOS_GHCIP_INDEX=PRESENT_READ_VERIFIED' "${serial_log_second}"
+if grep -q '^GHOS_GHCIP_INDEX=INITIALIZED_WRITE_READ_VERIFIED' "${serial_log_second}"; then
+  echo "second native boot rewrote the existing GHCIP index" >&2
+  exit 1
+fi
+index_sha_after=$(dd if="${disk_image}" bs=512 skip=70 count=2 status=none |
+  sha256sum | awk '{print $1}')
+[[ ${index_sha_before} == "${index_sha_after}" ]]
+python3 - "${disk_image}" <<'PY'
+import pathlib
+import sys
+
+with pathlib.Path(sys.argv[1]).open("rb") as disk:
+    disk.seek(63 * 512)
+    proof = disk.read(512)
+assert proof[0] == 0xA7
+assert proof[102:105] == bytes([0, 1, 1])
+PY
+
+cp "${disk_image}" "${corrupt_disk_image}"
+dd if=/dev/zero of="${corrupt_disk_image}" bs=512 seek=63 count=1 \
+  conv=notrunc status=none
+printf '\x58' | dd of="${corrupt_disk_image}" bs=1 seek=$((70 * 512)) \
+  count=1 conv=notrunc status=none
+corrupt_index_sha_before=$(dd if="${corrupt_disk_image}" bs=512 skip=70 count=2 \
+  status=none | sha256sum | awk '{print $1}')
+peer_port_corrupt=$((peer_port + 4))
+qemu_port_corrupt=$((qemu_port + 4))
+python3 "${source_root}/scripts/qemu-native-net-peer.py" \
+  --listen-port "${peer_port_corrupt}" \
+  --qemu-port "${qemu_port_corrupt}" \
+  --receipt "${peer_receipt_corrupt}" \
+  --login-only >"${peer_log_corrupt}" 2>&1 &
+peer_pid=$!
+set +e
+timeout 30 qemu-system-x86_64 \
+  -machine pc,accel=tcg \
+  -m 64M \
+  -drive "if=none,id=ghboot,format=raw,file=${corrupt_disk_image}" \
+  -device virtio-blk-pci,drive=ghboot,disable-modern=on,bootindex=0 \
+  -netdev "dgram,id=ghnet,local.type=inet,local.host=127.0.0.1,local.port=${qemu_port_corrupt},remote.type=inet,remote.host=127.0.0.1,remote.port=${peer_port_corrupt}" \
+  -device virtio-net-pci,netdev=ghnet,disable-modern=on,mac=52:54:00:26:71:98 \
+  -display none \
+  -monitor none \
+  -serial "file:${serial_log_corrupt}" \
+  -device isa-debug-exit,iobase=0xf4,iosize=0x04
+qemu_status=$?
+set -e
+
+[[ ${qemu_status} -eq 33 ]]
+wait "${peer_pid}"
+peer_pid=
+grep -q '^icmp_login_reply_count: 3$' "${peer_receipt_corrupt}"
+grep -q '^code_commit_reply_verified: false$' "${peer_receipt_corrupt}"
+grep -q '^GHOS_BOOT_ERROR=NATIVE_GHCIP_INDEX' "${serial_log_corrupt}"
+corrupt_index_sha_after=$(dd if="${corrupt_disk_image}" bs=512 skip=70 count=2 \
+  status=none | sha256sum | awk '{print $1}')
+[[ ${corrupt_index_sha_before} == "${corrupt_index_sha_after}" ]]
+python3 - "${corrupt_disk_image}" <<'PY'
+import pathlib
+import sys
+
+with pathlib.Path(sys.argv[1]).open("rb") as disk:
+    disk.seek(63 * 512)
+    proof = disk.read(512)
+assert proof[0] == 0xE1
+assert proof[43] == 0x6C
+assert proof[102:105] == bytes([0, 0, 0])
+PY
+
+observed_at=$(date --iso-8601=seconds)
+image_sha=$(sha256sum "${candidate}" | awk '{print $1}')
+cat >"${receipt}" <<EOF
+schema: guanghu.native-resident-qemu-test/v1
+receipt_id: GH-OS-LAB-001-NATIVE-RESIDENT-QEMU-001
+status: VERIFIED
+observed_at: ${observed_at}
+image:
+  architecture: x86_64
+  firmware: BIOS
+  size_bytes: 14848
+  candidate_start_lba: 34
+  candidate_sector_count: 29
+  proof_lba: 63
+  sha256: ${image_sha}
+resident_runtime:
+  initial_login_replies: 3
+  post_code_channel_login_replies: 10
+  remained_resident_until_recovery_command: true
+native_recovery:
+  command: HLDP-RECOVER-OS!
+  reply_verified_by_external_peer: true
+  recovery_beacon_lba_start: 68
+  recovery_beacon_sector_count: 2
+  ubuntu_menu_id: gnulinux-simple-9842d3d6-a839-4127-bda7-f19137effe71
+  write_read_verified_by_native_ghal: true
+  hardware_reset_after_verification: true
+gestational_continuity:
+  protocol: GLS-0845
+  native_index_lba_start: 70
+  native_index_sector_count: 2
+  blank_index_initialized_by_native_ghal: true
+  write_read_verified_by_native_ghal: true
+  second_boot_preserved_without_write: true
+  first_and_second_boot_index_sha256: ${index_sha_after}
+  unknown_nonzero_index_failed_closed_without_overwrite: true
+  registry_state: EMPTY
+  review_state: NOT_STARTED
+  persona_state: NOT_BORN
+acceptance:
+  qemu_resident_runtime: true
+  physical_server_resident_runtime: false
+  permanent_linux_replacement: false
+next_action: PHYSICAL_ONE_TIME_RESIDENT_AND_RECOVERY_GATE
+EOF
+cat "${serial_log}" >>"${receipt}.serial.log"
+cat "${serial_log_second}" >>"${receipt}.second-boot.serial.log"
+cat "${serial_log_corrupt}" >>"${receipt}.corrupt-index.serial.log"
--- a/product-source/hololake-platform/guanghu-os/scripts/verify-native-physical-return.sh
+++ b/product-source/hololake-platform/guanghu-os/scripts/verify-native-physical-return.sh
@ -0,0 +1,311 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -ge 3 && $# -le 4 ]] || {
+  echo "usage: verify-native-physical-return.sh <world-root> <recovery-root> <previous-boot-id> [bounded|resident-recovery]" >&2
+  exit 64
+}
+[[ ${EUID} -eq 0 ]] || {
+  echo "must run as root" >&2
+  exit 77
+}
+
+world_root=$(readlink -f "$1")
+recovery_root=$(readlink -f "$2")
+previous_boot_id=$3
+verification_mode=${4:-bounded}
+[[ ${verification_mode} == bounded || ${verification_mode} == resident-recovery ]]
+current_boot_id=$(cat /proc/sys/kernel/random/boot_id)
+[[ ${current_boot_id} != "${previous_boot_id}" ]]
+/guanghu/bin/ghctl authorize "${world_root}" reboot_and_recover_bs_sh_005 \
+  >/dev/null
+systemctl is-active --quiet guanghu-broadcast-tower.service
+systemctl is-active --quiet guanghu-code-channel.service
+
+dd if=/dev/vda of="${recovery_root}/lba63.native-proof.bin" \
+  bs=512 skip=63 count=1 status=none
+python3 - "${recovery_root}/lba63.native-proof.bin" "${verification_mode}" <<'PY'
+import pathlib
+import sys
+proof = pathlib.Path(sys.argv[1]).read_bytes()
+mode = sys.argv[2]
+assert len(proof) == 512
+assert proof[0] == 0xA7
+assert proof[1:].startswith(b"GHOS_NATIVE_LONG64_DISK_PROOF\x00")
+assert proof[32:36] == bytes([1, 1, 1, 1])
+assert proof[36:42] == bytes.fromhex("525400267198")
+assert proof[42] == 0x7F
+assert proof[43] == 0x00
+assert int.from_bytes(proof[44:46], "little") > 0
+assert int.from_bytes(proof[46:48], "little") > 0
+assert int.from_bytes(proof[48:50], "little") > 0
+assert int.from_bytes(proof[50:52], "little") == 0xE000
+assert int.from_bytes(proof[52:54], "little") == 0xE040
+assert proof[54:60] != bytes(6)
+assert proof[60:62] == bytes([1, 1])
+assert proof[62:64] == bytes([1, 1])
+assert proof[64:68] != bytes(4)
+assert proof[72:88] == b"HLDP-GHOS-LOGIN!"
+assert proof[88:90] == bytes([1, 1])
+assert proof[91:93] == bytes([1, 1])
+assert proof[93:99] == bytes([1, 1, 1, 1, 1, 1])
+if mode == "resident-recovery":
+    assert proof[90] == 13
+    assert proof[99:102] == bytes([1, 1, 1])
+else:
+    assert proof[90] == 3
+    assert proof[99:102] == bytes([0, 0, 0])
+assert proof[102] in (0, 1)
+assert proof[103:105] == bytes([1, 1])
+PY
+dd if=/dev/vda of="${recovery_root}/lba64.native-world-store.bin" \
+  bs=512 skip=64 count=1 status=none
+python3 - "${recovery_root}/lba64.native-world-store.bin" <<'PY'
+import pathlib
+import sys
+store = pathlib.Path(sys.argv[1]).read_bytes()
+assert len(store) == 512
+assert store.startswith(b"GHOS_HLDP_WORLD_STORE_V1\n")
+for identity in (
+    b"GHOS_WORLD_ID=GLW-ROOT-0001\n",
+    b"GHOS_DOMAIN_COUNT=5\n",
+    b"GHOS_DOMAIN_5=DOMAIN-FIFTH\n",
+    b"GHOS_BROADCAST_TOWER=BT-GH-ROOT-0001\n",
+    b"GHOS_CODE_CHANNEL=HLP-MOD-CODE-CHANNEL\n",
+    b"GHOS_AUTHORITY_LANGUAGE=HLDP\n",
+    b"GHOS_GESTATIONAL_ENVIRONMENT=UNDER_CONSTRUCTION\n",
+    b"GHOS_PERSONA_BIRTH=NOT_BORN\n",
+):
+    assert identity in store
+PY
+dd if=/dev/vda of="${recovery_root}/lba65.native-code-channel-store.bin" \
+  bs=512 skip=65 count=1 status=none
+python3 - "${recovery_root}/lba65.native-code-channel-store.bin" <<'PY'
+import pathlib
+import sys
+store = pathlib.Path(sys.argv[1]).read_bytes()
+assert len(store) == 512
+assert store.startswith(b"GHOS_CODE_CHANNEL_STORE_V1\n")
+for identity in (
+    b"GHOS_CODE_CHANNEL_ID=HLP-MOD-CODE-CHANNEL\n",
+    b"GHOS_CODE_CHANNEL_PROTOCOL=GLS-0237\n",
+    b"GHOS_CODE_CHANNEL_AUTHORITY=HLDP\n",
+    b"GHOS_CODE_CHANNEL_OBJECT_FORMAT=GUANGHU_NATIVE_OBJECTS\n",
+):
+    assert identity in store
+PY
+dd if=/dev/vda of="${recovery_root}/lba66.native-code-object.bin" \
+  bs=512 skip=66 count=1 status=none
+cmp -s "${recovery_root}/lba65.native-code-channel-store.bin" \
+  "${recovery_root}/lba66.native-code-object.bin"
+dd if=/dev/vda of="${recovery_root}/lba67.native-branch-receipt.bin" \
+  bs=512 skip=67 count=1 status=none
+python3 - "${recovery_root}/lba67.native-branch-receipt.bin" <<'PY'
+import pathlib
+import sys
+receipt = pathlib.Path(sys.argv[1]).read_bytes()
+assert receipt.startswith(b"GHOS_BRANCH_MAIN_V1\n")
+assert b"channel=HLP-MOD-CODE-CHANNEL\n" in receipt
+assert b"branch=guanghu/main\n" in receipt
+assert b"object_lba=66\n" in receipt
+assert b"receipt=HLDP\n" in receipt
+PY
+dd if=/dev/vda of="${recovery_root}/lba70-71.gestational-index.bin" \
+  bs=512 skip=70 count=2 status=none
+python3 - "${recovery_root}/lba70-71.gestational-index.bin" <<'PY'
+import pathlib
+import sys
+index = pathlib.Path(sys.argv[1]).read_bytes()
+assert len(index) == 1024
+identity = index[:512]
+root = index[512:]
+assert identity.startswith(b"GHOS_GHCIP_INDEX_V1\n")
+for field in (
+    b"GHCIP_PROTOCOL=GLS-0845\n",
+    b"GHCIP_WORLD_ID=GLW-ROOT-0001\n",
+    b"GHCIP_PERSONA_BIRTH_GATE=GH-PERSONA-BIRTH-CONDITION-0001\n",
+    b"GHCIP_CONTENT_ROLE=CONTENT_ADDRESSED_ROOT_INDEX_ONLY\n",
+    b"GHCIP_WRITE_POLICY=APPEND_ONLY_VERIFIED_ROOT_ADVANCE\n",
+    b"GHCIP_IDENTITY_LBA=70\n",
+    b"GHCIP_ROOT_LBA=71\n",
+):
+    assert field in identity
+assert root.startswith(b"GHOS_GHCIP_ROOT_V1\n")
+for field in (
+    b"GHCIP_PROTOCOL=GLS-0845\n",
+    b"GHCIP_REGISTRY_STATE=EMPTY\n",
+    b"GHCIP_REVIEW_STATE=NOT_STARTED\n",
+    b"GHCIP_HISTORICAL_TIME_WATERMARK=NONE\n",
+    b"GHCIP_PERSONA_STATE=NOT_BORN\n",
+    b"GHCIP_CONTENT_ROOT=NONE\n",
+    b"GHCIP_LAST_VERIFIED_BATCH=NONE\n",
+):
+    assert field in root
+PY
+proof_observed_at=$(date --iso-8601=seconds)
+proof_sha=$(sha256sum "${recovery_root}/lba63.native-proof.bin" |
+  awk '{print $1}')
+world_store_sha=$(sha256sum \
+  "${recovery_root}/lba64.native-world-store.bin" | awk '{print $1}')
+code_channel_store_sha=$(sha256sum \
+  "${recovery_root}/lba65.native-code-channel-store.bin" | awk '{print $1}')
+code_object_sha=$(sha256sum \
+  "${recovery_root}/lba66.native-code-object.bin" | awk '{print $1}')
+branch_receipt_sha=$(sha256sum \
+  "${recovery_root}/lba67.native-branch-receipt.bin" | awk '{print $1}')
+gestational_index_sha=$(sha256sum \
+  "${recovery_root}/lba70-71.gestational-index.bin" | awk '{print $1}')
+gestational_index_initialized=$(python3 - "${recovery_root}/lba63.native-proof.bin" <<'PY'
+import pathlib
+import sys
+print("true" if pathlib.Path(sys.argv[1]).read_bytes()[102] == 1 else "false")
+PY
+)
+if [[ ${verification_mode} == resident-recovery ]]; then
+  dd if=/dev/vda of="${recovery_root}/lba68-69.recovery-beacon-after-boot.bin" \
+    bs=512 skip=68 count=2 status=none
+  if grep -aFq 'guanghu_recovery=ubuntu' \
+    "${recovery_root}/lba68-69.recovery-beacon-after-boot.bin"; then
+    echo "native recovery beacon was not consumed" >&2
+    exit 1
+  fi
+  if ! cmp -s "${recovery_root}/lba68-69.recovery-beacon-after-boot.bin" \
+    /usr/lib/guanghu-os/guanghu-recovery-clear.env; then
+    echo "consumed native recovery beacon does not match the sealed clear template" >&2
+    exit 1
+  fi
+  recovery_beacon_sha=$(sha256sum \
+    "${recovery_root}/lba68-69.recovery-beacon-after-boot.bin" |
+    awk '{print $1}')
+  native_login_reply_count=13
+  native_resident_runtime=true
+  native_recovery_command=true
+  fallback_mechanism=GHNRP_RAW_RECOVERY_BEACON
+else
+  recovery_beacon_sha=NOT_APPLICABLE
+  native_login_reply_count=3
+  native_resident_runtime=false
+  native_recovery_command=false
+  fallback_mechanism=GRUB_NEXT_ENTRY_ONE_TIME
+fi
+cat >"${recovery_root}/DISK-PROOF-CONSUMPTION.hldp" <<EOF
+schema: guanghu.native-disk-proof-consumption/v1
+receipt_id: GH-OS-LAB-001-NATIVE-DISK-PROOF-001
+status: OBSERVED_NOT_YET_CLEARED
+observed_at: ${proof_observed_at}
+node_id: BS-SH-005
+lba: 63
+sha256: ${proof_sha}
+world_store_lba: 64
+world_store_sha256: ${world_store_sha}
+code_channel_store_lba: 65
+code_channel_store_sha256: ${code_channel_store_sha}
+code_object_lba: 66
+code_object_sha256: ${code_object_sha}
+branch_receipt_lba: 67
+branch_receipt_sha256: ${branch_receipt_sha}
+gestational_index_lba_start: 70
+gestational_index_sector_count: 2
+gestational_index_sha256: ${gestational_index_sha}
+gestational_index_initialized_this_boot: ${gestational_index_initialized}
+verification_mode: ${verification_mode}
+native_resident_runtime: ${native_resident_runtime}
+native_recovery_command: ${native_recovery_command}
+long_mode_marker: GHOS_NATIVE_LONG64_DISK_PROOF
+previous_linux_boot_id: ${previous_boot_id}
+recovered_linux_boot_id: ${current_boot_id}
+EOF
+chmod 0400 "${recovery_root}/DISK-PROOF-CONSUMPTION.hldp"
+sync
+dd if=/dev/zero of=/dev/vda bs=512 seek=63 count=1 \
+  conv=notrunc,fsync status=none
+cleared_proof=$(mktemp)
+trap 'rm -f "${cleared_proof}"' EXIT
+dd if=/dev/vda of="${cleared_proof}" bs=512 skip=63 count=1 status=none
+cmp -s "${cleared_proof}" <(head -c 512 /dev/zero)
+
+broadcast_health=$(curl --fail --silent http://127.0.0.1:8077/healthz)
+code_health=$(curl --fail --silent http://127.0.0.1:3080/api/healthz)
+grep -q '"domain_count":5' <<<"${broadcast_health}"
+grep -q '"status":"ok"' <<<"${broadcast_health}"
+grep -q '"status": "pass"' <<<"${code_health}"
+
+observed_at=$(date --iso-8601=seconds)
+cat >"${recovery_root}/NATIVE-PHYSICAL-BOOT-RECEIPT.hldp" <<EOF
+schema: guanghu.native-physical-boot-receipt/v1
+receipt_id: GH-OS-LAB-001-NATIVE-PHYSICAL-BOOT-001
+status: VERIFIED
+observed_at: ${observed_at}
+node_id: BS-SH-005
+instance_id: lhins-14w5y3ce
+boot:
+  previous_linux_boot_id: ${previous_boot_id}
+  recovered_linux_boot_id: ${current_boot_id}
+native_proof:
+  disk_lba: 63
+  sha256: ${proof_sha}
+  marker: GHOS_NATIVE_LONG64_DISK_PROOF
+  cleared_after_receipt: true
+  cpu_mode: LONG64
+  linux_present_during_native_execution: false
+ghal:
+  virtio_net_discovered: true
+  virtio_block_discovered: true
+  virtio_net_queue_ready: true
+  virtio_block_queue_ready: true
+  native_mac: 52:54:00:26:71:98
+  completion_stage: 0x7f
+  error_code: 0x00
+  net_io_base: 0xe000
+  block_io_base: 0xe040
+  arp_gateway_tx_complete: true
+  arp_gateway_rx_verified: true
+  ipv4_login_request_verified: true
+  icmp_login_reply_tx_complete: true
+  login_magic: HLDP-GHOS-LOGIN!
+  native_hldp_world_store_written: true
+  native_hldp_world_store_read_verified: true
+  native_hldp_world_store_lba: 64
+  native_hldp_world_store_sha256: ${world_store_sha}
+  native_login_reply_count: ${native_login_reply_count}
+  native_code_channel_store_written: true
+  native_code_channel_store_read_verified: true
+  native_code_channel_store_lba: 65
+  native_code_channel_store_sha256: ${code_channel_store_sha}
+  native_code_commit_command_verified: true
+  native_code_object_written_read_verified: true
+  native_code_object_lba: 66
+  native_code_object_sha256: ${code_object_sha}
+  native_branch_move_command_verified: true
+  native_branch_receipt_written_read_verified: true
+  native_branch_receipt_lba: 67
+  native_branch_receipt_sha256: ${branch_receipt_sha}
+  native_gestational_continuity_protocol: GLS-0845
+  native_gestational_index_lba_start: 70
+  native_gestational_index_sector_count: 2
+  native_gestational_index_sha256: ${gestational_index_sha}
+  native_gestational_index_initialized_this_boot: ${gestational_index_initialized}
+  native_gestational_index_read_verified: true
+  native_gestational_registry_state: EMPTY
+  native_gestational_review_state: NOT_STARTED
+  native_persona_state: NOT_BORN
+  native_resident_runtime: ${native_resident_runtime}
+  native_recovery_command: ${native_recovery_command}
+  native_recovery_protocol: GHNRP
+  native_recovery_beacon_lba_start: 68
+  native_recovery_beacon_write_read_verified: ${native_recovery_command}
+  native_recovery_beacon_consumed_sha256: ${recovery_beacon_sha}
+fallback:
+  mechanism: ${fallback_mechanism}
+  ubuntu_recovered: true
+hosted_continuity:
+  five_domains: VERIFIED
+  broadcast_tower: RUNNING
+  code_channel: RUNNING
+acceptance:
+  physical_server_native_boot: true
+  permanent_linux_replacement: false
+next_action: IMPLEMENT_NATIVE_STORAGE_NETWORK_AND_LOGIN
+EOF
+chmod 0400 "${recovery_root}/NATIVE-PHYSICAL-BOOT-RECEIPT.hldp"
+cat "${recovery_root}/NATIVE-PHYSICAL-BOOT-RECEIPT.hldp"