fix(drivers): check retained package before reinstall

[frahlg]

An install recorded before the format column existed could be relabeled as a direct-manifest driver when its repository alias was reused. If its Sourceful package envelope remained, startup then failed after activation had already replaced the rollback record with the same path.

Check for a retained package envelope before writing files or activation state. Any envelope presence, including corrupt files and dangling symlinks, rules out a direct-manifest reinstall. When an older row has no envelope and no recorded format, require the existing signed backfill check for its source, exact artifact and v1 contract. A missing file cannot establish legacy format. This also protects retained files without a database row.

Tests exercise valid, corrupt, dangling and missing envelopes, the unchanged activation and rollback record on rejection, and valid same-format reinstalls. Verified legacy format may persist if a later install step fails; the backfill leaves activation and rollback state intact. The previous installer fails the new regressions.

Validation: make verify and go test -race ./internal/driverrepo ./internal/drivers -count=1 pass. An overlay of the installer from 8617c7e9 fails all four negative cases, including replacement of the active symlink. Positive tests cover canonical reinstall and an older direct-manifest reinstall followed by Registry startup and default. Independent source review and a second focused race run found no further issues.

Addresses the late review of #1115. These tests use local signed fixtures and synthetic adapters; no physical device or driver source change is included.

---

Note

Medium Risk
Changes the driver install activation path and format classification for legacy rows; behavior is fail-closed with new regression tests around rollback preservation.

Overview
Fixes a case where reinstalling over a pre-format-column install could treat a retained Sourceful driver as a direct-manifest (FTWManifestV1) install when the same repository id was reused, leaving activation/rollback in a bad state before startup failed.

installResolved now runs these checks before writing the artifact or touching activation: if the target repo is direct-manifest, any on-disk package envelope next to the retained artifact (including corrupt files or dangling symlinks) blocks the reinstall; when the DB row has empty RepositoryFormat and no envelope, install requires recordDirectManifestFormat (signed legacy metadata) instead of assuming v1.

Rejected installs leave the active install row, rollback pointer, Lua artifact, envelope, and active symlink unchanged. New tests cover envelope variants, canonical Sourceful reinstall, and verified legacy direct-manifest reinstall through driver registry startup.

^{Reviewed by Cursor Bugbot for commit 13de3cd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_11e1826c-24c4-431d-b13f-d514ef47d5a6)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T19:44:24.526428Z	13de3cd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.