[xxvcc]

Summary

Prepare v2.10.9 with fixes for signed bootstrap downgrades, SSH Include path analysis through symlink parents, and incomplete Latest restoration after publication signals. Align the release/rebuild toolchain with Go 1.26.10 and remove the unused ID-only at cancellation API.

Bootstrap checks the signed candidate version before execution and holds the lifecycle lock through installation and reactivation. Explicit recovery requires both a pinned release and LTA_ALLOW_DOWNGRADE=1. It now commits directly and reports through its exit status/output; the former candidate install audit event is no longer emitted, as documented in both installation guides.

The static version scan normalizes NUL bytes before matching so BusyBox utilities detect duplicate witnesses, and fails closed on conversion, matching or size-limit failures. Regression coverage runs both default tools and explicit BusyBox applets across available shells.

The release procedure now defines a shared GitHub publication lock with atomic acquisition, ownership checks and conditional cleanup across workstations.

Testing

• Build, vet with ordinary/integration tags, gofmt, Staticcheck with both tags, module verification and govulncheck pass with Go 1.26.10.

• Ordinary and race suites each pass 2,042 tests/subtests. All 136 non-root skips pass in the root suite.

• Serialized root integration and integration-race suites each pass 2,594 tests/subtests with no test skips in disposable Debian containers.

• Shell syntax, ShellCheck, actionlint, shared safety primitives and 49 Python mirror tests pass; static amd64/arm64 builds pass.

• Real OpenSSH comparisons, publisher signal fault injection, bootstrap version/lock/durability regressions and signed installer integration pass.

• Real systemd/SSH/PTY/PAM/sudo canary covers install, expiry, active-session revocation, persistent cleanup across a container restart and uninstall.

• The final BusyBox correction passes Debian/Ubuntu real BusyBox regression matrices, signed ELF installer/fallback integration, and complete releasecheck/selfmanage race suites: 711 ordinary and 761 root-integration passing test events, with no skips.

Safety Notes

• No credentials, local operations playbook or production account data are included. Containers and fixture credentials were removed.
• Kernel reboot, SELinux, live atd and arm64 runtime behavior were not exercised. Compatibility and lifecycle recovery protections remain in place.
• The full local-suite counts above cover the original audit-fix snapshot. Subsequent changes include release documentation and the BusyBox scan correction; focused regression results and the final PR/release CI gates validate those final changes.