[stuart902]

Summary

Addresses OrchardLinux/orchard#37. Device-runtime support is tracked in OrchardLinux/orchard#12.
Depends on OrchardLinux/hardware#14.
Adds Keep filesystem (default), Reset filesystem, and Cancel choices for existing ext4 targets.

• Offers reset only when recovery advertises reset-ext4-v1.
• Warns that reset destroys all partition contents without a backup.
• Requires literal reset <partition ID> confirmation.
• Saves uncertainty before dispatch, validates the receipt, and rediscovers the target before installation.
• Stops after failed or uncertain reset without automatic retry.
• Corrects cancellation and failure messages.

Requires the companion hardware runtime and rebuilt installer recovery. Older recovery retains its existing workflow. Protocol version and dependency bounds are unchanged.

CI tests the pinned hardware candidate, supports a hardware repository input, and uses a compatible default hardware version.

Validation

• 233 tests and mypy pass on Python 3.9 and 3.12.
• Wheel/source builds and dependency checks pass.
• Coverage includes Keep, cancellation, literal consent, capabilities, receipt and target mismatches, interruption, no retry, directory replacement, and unformatted initialization.

Manual testing confirmed Keep then Cancel, reset and installation to system readiness, and two subsequent boots with the matching launcher. Later host consent and message changes have automated coverage.

[henrikklee]

Thanks, Stuart. This is careful work, and the safety design is much appreciated. We are closing it because the installer is being replaced: installation moves into a single device-side script in the CLI (installer v2), and runtime/j71b/ goes away. Installer v2 already covers this: replacing an existing Linux partition, behind a typed confirmation bound to the partition table and the exact partition. Thanks again!