Development record

A garbled release mark makes the rollback floor disappear without a word. ReadReleaseMark in internal/core/ahoy reads an unparsable mark as no mark, so ahoy install and update adopt any genuine release, however old, and nothing tells the person their newest-release floor is gone. The fail-open is deliberate and safe: the mark is read only when this account owns it and no one else can write it, so whoever can garble it could already delete or lower it, and a copy admitted this way still passes the provenance check for the release it names (the warm path and hooks/bootstrap.sh fail open the same way). What is missing is the diagnostic. Route without abcd: none; the mark and its floor are abcd's own, so abcd fixes it.