[irzhywau]

Note

This is part of a stacked PR chain — review only the commits of this checkpoint; earlier work is in the PRs below it in the stack.

Stack (top → bottom)

• feat(protected-content): runtime lifecycle — mint, buy, play, purchase closeout #36 feat/protected-content-runtime-lifecycle
• feat(protected-content): chain rights evidence and typed decisions #35 feat/protected-content-rights
• ➡️ feat(protected-content): Runtime release authority and persisted state #34 feat/protected-content-runtime (this PR)
• feat(protected-content): sign rights requests with Wallet #33 feat/protected-content-wallet-rights
• feat(protected-content): custody provider protocol and process #32 feat/protected-content-custody-provider
• feat(protected-content): bridge authenticated release reconstruction #31 feat/protected-content-key-reconstruction
• feat(protected-content): threshold custody envelopes and key reconstruction #30 feat/protected-content-custody
• feat(protected-content): canonical content identities, rights grants, release contracts #29 feat/protected-content-contracts
• feat(collaboration): Profile/Chat product UI and Home window chrome #28 review/collaboration-product-integration
• feat(collaboration): signed network protocol, Carrier transport, Profile authority #27 review/collaboration-foundation
• main

Base: feat/protected-content-wallet-rights ← Head: feat/protected-content-runtime (checkpoint 8 of 10)

Commits

• 7f60911 feat(protected-content): persist Runtime release state
• b00bfee feat(protected-content): coordinate Runtime release authority

[irzhywau]

One commit was added on top of b00bfeeb: a8ac6dc8, the merge of the updated parent feat/protected-content-wallet-rights (checkpoint 7 tip, CI-green). No fixes were needed on this checkpoint itself.

Review notes: the new source-only elastos-protected-content-runtime crate holds together well — RuntimeReleaseCoordinator rejects any Wallet exchange that is not the dedicated rights-signature operation and cross-checks the canonical rights request against the signed operation statement; the journal persists the full operation before any provider effect (crash-safe resume: replayed terminals return as-is, started-but-unfinished effects return a typed nonterminal); provider results are validated against the pinned Runtime issuer, node decisions verified through the authenticated operation (denial = journaled terminal), contributions identity-checked per node, and every provider failure collapses to a journaled fail-closed nonterminal. Zero panics/unwraps in non-test code; the journal reuses the established owner-only/create_new/fsync/O_NOFOLLOW discipline; the crate natively uses the post-checkpoint-6 pinned-issuer contracts API. 19 tests.

Verified locally at the tip: all source gates incl. the provisional-retirement guard, cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings (cleaned fingerprints), cargo test --workspace — 2003 passed; only the known macOS mDNS-environment room::direct pair, green on this CI run.