[itlezy]

Nightly preflight notes currently describe platforms before their actual candidate inventory is verified, and downloads are difficult to find. Render platform download tables, immutable OCI references and supporting manifest/SBOM/provenance links from the verified candidate instead. Show experimental Android limitations only when those native archives are present; APK/signing remains deferred.

Serialize finalization for each release directory: validate the original assembly, insert inventory-backed notes, refresh checksums, then write and revalidate the candidate. Record rollback ownership before each public-file replacement so an interrupt immediately after a successful rename restores the original notes/checksum pair. Existing candidates cannot be rewritten. Postcommit backup cleanup errors warn while preserving the committed result; KeyboardInterrupt remains visible. Full and Windows/Linux format-4 profiles retain their exact inventories and publication restrictions, and fresh-profile policy is unchanged.

Validation:

• Current head 02ba6cb4175b3dd8ff10d1b9213019d0ea58c9bd: direct release-publishing owner passed 47/47 tests. Both new successful-rename-then-interrupt controls failed against the preceding b19312c4 source, then passed with the fix, including byte-for-byte restoration, absent candidate and successful retry.
• Current normal pinned-npm commit/push hooks passed privacy, hygiene, 277 policy tests with one existing platform skip, and rustfmt. Push receipt: reports/local-check/emulebb-rust/20261111T201057Z-82f9b157.
• Earlier b73dbd7b checkpoint passed its normal hooks with 271 policy tests and one existing Windows platform skip. That evidence belongs to the earlier source; its four original patches and authorship were preserved through the parent-owned refresh onto actual main 4466518b.
• Tests cover real file hashes, note/checksum/candidate failure injection, a competing finalizer process, committed cleanup faults/interrupts and absent-platform claims. Fresh exact-head hosted checks and actual nightly guidance/artifact verification remain required before final delivery.
• The parent intentionally deferred this head's incomplete full hosted qualification for prerequisite queue priority and requested cancellation of its unfinished runs. This is neither a full pass nor a product failure; fresh full applicable checks are required after the final-base restack.

Parent-coordinated parallel consolidation with CI045 #322; both PRs use the approved coordination path. This outcome owns only tools/nightly_release.py, tools/release_publish.py and their two direct test files. CI045 owns prepared Linux workflow/image consumption and its direct contracts; the release workflow remains reserved to that owner and the parent. No prepared-image dispatch, local heavy build or gate borrowing is part of this change. The parent owns subsequent main restacks, fresh qualification, merge and lifecycle cleanup.

Refs #305 (RUST-CI-046).

[itlezy]

Parent-coordinated supersession: qualification runs for this head have been cancelled to prioritize #321, which removes unused Slint/fontconfig APT setup after repeated mirror-DNS failures before Cargo. Source commits and completed evidence are preserved. The parent will refresh this branch onto the actual merged prerequisite and rerun all applicable gates before integration. These deliberate cancellations do not establish a product regression or a passing qualification.