@@ -22,6 +22,17 @@
   `CELLSCRIPT_REGISTRY_URL` Git/offline override, and the website renders the
   live Registry with a clearly labelled read-only bundled mirror only when the
   API is unavailable. The former Registry Coming Soon surface is removed.
+  First-publish admission is now user-reachable end to end: `cellc auth
+  namespace claim` and the submit page's **Claim namespace** action explicitly
+  establish namespace ownership between capability registration and publish.
+  Publish admission now commits package, snapshot, version, capability-use,
+  acceptance-audit, and completed-idempotency state in one database transaction;
+  pre-admission failures release the request-owned nonce and retry reservation,
+  while production readiness verifies both managed object-store prefixes and
+  volume initialization repairs their ownership and modes recursively.
+  Explicit unverified/quarantined install acknowledgements are persisted in
+  dependency tables, preventing lock refreshes and later builds from losing the
+  caller's risk policy.
 - Close the 0.23 syntax-audit consistency gaps: canonical type declarations
   now use comma-terminated fields, syntax-combination gates cover canonical and
   comma-free compatibility input, checked example mirrors use named `U64_MAX`
 
@@ -471,6 +471,7 @@ pub fn run(root: &Path) -> Result<()> {
             "registry package '{}/{}@{}' has no source_hash in registry.json",
             "public registry package '{}/{}@{}' has no immutable source snapshot",
             "source_hash mismatch for '{}/{}@{}': expected '{}', got '{}'",
+            "allow_unverified: detailed.allow_unverified",
             "Git { url: String, revision: String }",
             "pub fn consistency_issues(&self, manifest: &PackageManifest) -> Vec<String>",
             "pub fn replace_with_resolved(&mut self, resolved: &HashMap<String, ResolvedPackage>)",
@@ -482,6 +483,7 @@ pub fn run(root: &Path) -> Result<()> {
         &[
             "cellc_rejects_registry_dependency_without_namespace",
             "cellc_build_resolves_registry_dependency_and_writes_phase1_lockfile",
+            "cellc_auth_namespace_claim_posts_signed_capability_payload_to_registry_api",
             "cellc_install_path_updates_lockfile_and_remove_prunes_it",
             "cellc_fmt_subcommand_formats_sources",
             "cellc_run_subcommand_executes_pure_elf_package",
@@ -494,6 +496,7 @@ pub fn run(root: &Path) -> Result<()> {
         "tests/registry.rs",
         &[
             "package_manager_resolves_registry_dependency_with_source_hash_from_local_git_fixture",
+            "package_manager_persists_unverified_registry_policy_in_dependency_manifest",
             "package_manager_rejects_registry_source_hash_mismatch",
             "lockfile_consistency_accepts_matching_registry_source",
         ],
 
@@ -60,6 +60,13 @@ The `ci` gate also typechecks, tests, and performs a Wrangler dry-run build of
 database/static-object shape to the compiler-generated registry entry. It is
 local service coverage, not evidence
 that Cloudflare, R2, Hyperdrive, Neon, DNS, or a production deployment works.
+The CLI coverage includes the explicit first-publish admission sequence:
+`cellc auth capability submit`, `cellc auth namespace claim`, then
+`cellc publish`. Capability registration does not silently claim a namespace;
+the claim response must be `active` before the write API accepts a version.
+Explicit `--allow-unverified` and `--allow-quarantined` install choices are
+persisted per dependency so the lock refresh and later builds exercise the
+same auditable resolver policy.
 
 The full gate reads `scripts/ckb_acceptance_pin.json` and rejects a CKB checkout
 whose revision or worktree differs from the pin. Its report binds the CKB
 
@@ -311,6 +311,9 @@ cellc auth capability create --principal-id <principal_id> --scope publish:names
 cellc auth capability submit --payload capability-payload.json --joyid-signature joyid-signature.json
   -> signed payload is submitted to the registry write API
   -> registry records the key's scope, expiry, principal_type, and principal_id
+cellc auth namespace claim --namespace namespace --payload capability-payload.json --joyid-signature joyid-signature.json
+  -> the same JoyID authorisation proves ownership of the namespace named by the publish scope
+  -> reserved namespaces remain pending until administrator review activates them
 
 cellc publish
   -> CLI signs the publish payload with the local publisher credential
@@ -386,9 +389,9 @@ registry service:
   `--idempotency-key` or `CELLSCRIPT_REGISTRY_IDEMPOTENCY_KEY` when retrying the
   same signed publish request;
 - if publish admission fails after reserving the retry key but before accepting
-  the package version, the registry releases that `processing` reservation; the
-  consumed signed nonce still cannot be reused, so retry with a fresh publish
-  payload/signature and the same CI retry key;
+  the package version, the registry releases that `processing` reservation and
+  only the nonce row created by the failed request, so the exact signed request
+  can be retried; admission metadata then commits in one database transaction;
 - build verification, artifact checks, deployment checks, chain RPC reads, and
   search indexing run asynchronously in bounded queues;
 - rate limits apply per IP, ASN, JoyID principal, credential, namespace, and
@@ -458,14 +461,17 @@ mirrored `registry.json` and tag path.
 ```bash
 cellc auth capability create --principal-id <principal_id> --scope publish:cellscript/amm_pool --expires 90d --json > capability-payload.json
 cellc auth capability submit --payload capability-payload.json --joyid-signature joyid-signature.json
+cellc auth namespace claim --namespace cellscript --payload capability-payload.json --joyid-signature joyid-signature.json
 cellc publish
 ```
 
 If `--capability-pubkey` is omitted, `cellc auth capability create` generates a
 local P-256 capability key and stores the private key in the OS keychain. The
 printed payload is the exact JoyID challenge to sign and submit to the registry
-write API through `cellc auth capability submit`. Once the capability is
-registered, `cellc publish` computes a source hash from the current source tree,
+write API through `cellc auth capability submit`. The namespace must then be
+claimed with `cellc auth namespace claim`; a reserved claim may need operator
+review before it becomes active. Once the capability and namespace ownership
+are active, `cellc publish` computes a source hash from the current source tree,
 reads build artifacts for their hashes, signs the concrete publish payload with
 the capability key, uploads an immutable source snapshot, and submits the
 version entry to the registry. A successful publish returns the canonical
@@ -602,7 +608,9 @@ source-hash mismatch rejection.
 **Production snapshot resolution**: public status authority, required snapshot
 descriptors, bounded no-redirect download, object SHA-256, safe unique paths,
 per-file BLAKE2b, package-coordinate checks, whole-tree source hash, and atomic
-cache materialisation.
+cache materialisation. Explicit `--allow-unverified` / `--allow-quarantined`
+installs persist the chosen risk policy in the dependency table so later lock
+refreshes and builds enforce the same auditable choice.
 
 **Package/build identity**: namespace initialization, build lockfile identity,
 package verification, artifact/metadata/schema/ABI/constraints hash recording,
 
@@ -158,9 +158,9 @@ The CLI sends an `Idempotency-Key` on publish; it can derive the key from the
 exact request or accept `--idempotency-key` /
 `CELLSCRIPT_REGISTRY_IDEMPOTENCY_KEY`. If admission fails after reserving the
 key but before the package version is accepted, the registry releases that
-`processing` reservation. Because the signed publish nonce may already be
-consumed, retrying with the same CI retry key requires a new publish payload and
-capability signature.
+`processing` reservation and the nonce row owned by that failed request, so the
+same signed request can be retried. Package, snapshot, version, capability-use,
+acceptance-audit, and completed-idempotency records are committed atomically.
 
 ## CI Publishing
 
@@ -215,13 +215,13 @@ Current production abuse controls:
 - principal-scoped quota and namespace-claim cooldown are counted only after
   the JoyID signature has been verified, so forged payloads cannot burn another
   publisher's principal quota;
-- signed publish nonces are consumed before object storage writes, so replayed
-  publish payloads fail before expensive work;
+- signed publish nonces are reserved before object storage writes, so replayed
+  publish payloads fail before expensive work; a failed pre-admission request
+  releases only its own nonce row so the exact request remains safely retryable;
 - `Idempotency-Key` is supported for publish retries: the same logical request
   replays the stored response, while the same key with different payload content
   is rejected; failed pre-admission writes release a matching `processing`
-  reservation so CI can retry with the same retry key and a newly signed publish
-  payload;
+  reservation and request-owned nonce so CI can retry the same signed payload;
 - request body, metadata field, source snapshot, and artifact sizes are capped;
 - duplicate source/manifest hashes are deduplicated or throttled;
 - existing package versions are rejected before source snapshot writes;
@@ -373,6 +373,9 @@ Default resolver policy:
   `--allow-unverified`;
 - quarantined entries require a stronger explicit flag such as
   `--allow-quarantined`;
+- `cellc install` persists either acknowledgement on that dependency's
+  `Cell.toml` table, so lock refreshes and later builds preserve the explicit
+  choice instead of silently dropping it;
 - default search, recommendations, and production-visible package lists show
   only entries that passed the required baseline checks;
 - exact pins keep reproducibility, but warning and explicit-allow policy must
 
@@ -27,6 +27,8 @@ the Off-Chain Session Runtime profile remain roadmap work.
 | Build identity | The resolved profile independently combines edition, target, primitive assurance, metadata schemas, and entry/witness ABIs, then binds them into metadata, registry, lock, deployment, receipt, and builder records. |
 | Registry contract | The deployed publish contract requires Edition 2026 plus its compatibility-profile hash from CLI signature through API, Postgres, version-addressed JSON, and website; assurance states require ordered evidence. |
 | Registry operations | `api.registry.cellscript.dev` and `registry.cellscript.dev` run as an isolated self-hosted Postgres/Node/object-volume/read-only-nginx stack behind trusted TLS. |
+| Registry retry safety | Pre-admission failures release only the failed request's nonce and retry reservation; accepted metadata commits transactionally, and readiness covers the actual managed object prefixes. |
+| Registry install policy | Explicit unverified/quarantined install acknowledgements persist per dependency, so lock refresh and subsequent builds retain the same auditable risk choice. |
 | Tooling | CLI, LSP, WASM, website bindings, examples, and package tooling use the same edition contract. |
 | Syntax audit | Canonical type fields use trailing commas, checked examples use named `u64` boundaries, and compatibility plus CKB-VM regressions cover both source and witness placement. |
 | Native gate | Active test, fixture, evidence, and release tooling is Rust, shell, or Node; repository policy rejects Python source reintroduction. |
@@ -151,6 +153,10 @@ states.
   compatibility-profile hash, and use the checked-in fixture only as an
   explicitly labelled read-only mirror during API failure. The Coming Soon
   surface is removed.
+- `cellc auth namespace claim` and the submit page's **Claim namespace** action
+  expose the namespace-ownership admission step required before a package's
+  first public publish. Capability registration no longer appears to imply a
+  claim that the write API never created.
 - Production operations include dependency-aware readiness, bounded proxy and
   application request bodies, persistent Postgres/object volumes, and a daily
   systemd backup. The first backup passed SHA-256 checks plus non-destructive
@@ -260,6 +266,14 @@ curl --fail --silent --show-error https://registry.cellscript.dev/health
 curl --fail --silent --show-error https://cellscript.dev/registry/ > /dev/null
 ```
 
+On 2026-07-31, a disposable cryptographically valid WebAuthn-shaped P-256
+fixture completed capability registration, namespace claim, signed publish,
+same-request idempotent replay, static snapshot reads, a fresh-directory
+install/check/build, capability revocation, and rejection of a later publish.
+Its exact database and live object records were removed after the test; the six
+object files remain in the server's isolated recovery directory rather than the
+served object volume.
+
 These endpoints prove the deployed service boundary, not a publisher-owned
 JoyID signature or first-package install. That interactive positive flow
 remains the explicit adoption checkpoint.
 
@@ -71,9 +71,14 @@ flow, then publish:
 ```bash
 cellc auth capability create --principal-id <principal_id> --scope publish:cellscript/amm_pool --expires 90d --json > capability-payload.json
 cellc auth capability submit --payload capability-payload.json --joyid-signature joyid-signature.json
+cellc auth namespace claim --namespace cellscript --payload capability-payload.json --joyid-signature joyid-signature.json
 cellc publish --json
 ```
 
+Namespace ownership is an explicit admission step, not a side effect of
+capability registration. The claim must be `active` before the first publish;
+reserved namespaces may return a pending review status.
+
 The public write API admits package metadata, but consumers still verify the
 source and build identity locally.
 
@@ -128,6 +133,11 @@ source snapshot. It verifies the snapshot descriptor's SHA-256, rejects opaque
 or path-escaping content, verifies every file's BLAKE2b digest, reconstructs the
 source tree atomically, and checks `Cell.toml`, source hash, Edition 2026, and
 compatibility-profile identity.
+For a direct `source_published` or `indexed_pending` install, pass
+`--allow-unverified`; incident review of a quarantined entry additionally needs
+`--allow-quarantined`. `cellc install` persists these acknowledgements on that
+dependency's `Cell.toml` table, so lock refreshes and later builds retain the
+same explicit policy.
 `CELLSCRIPT_REGISTRY_URL` is an explicit Git/offline override, not an automatic
 fallback from a failed production lookup. Registry packages otherwise use the
 same fail-closed principle as path and Git dependencies: the selected source
 
@@ -197,6 +197,9 @@ alternative deployment, not a claim about the current topology.
   mirror used only when the API is unavailable.
 - [x] Keep the CCC/JoyID submit page on the same canonical
   `cellscript-registry-auth-v1` capability protocol.
+- [x] Expose namespace ownership as an explicit first-publish step through
+  `cellc auth namespace claim` and the submit page, matching the deployed
+  `/v1/namespaces/claim` admission boundary.
 - [x] Implement and expose public search/detail/evidence reads plus ordered
   evidence promotions.
 - [ ] Complete a publisher-owned JoyID capability, namespace claim, publication,
@@ -212,8 +215,8 @@ alternative deployment, not a claim about the current topology.
   key persistence in the OS keychain, and CI signing via
   `CELLSCRIPT_CAPABILITY_PRIVATE_KEY_PKCS8_B64`.
 - Confirm idempotency (`Idempotency-Key`, `x-idempotency-status: replayed`),
-  nonce consumption ordering, and the fail-fast-before-object-storage rule
-  against the live write service.
+  request-owned nonce release on pre-admission failure, transactional admission,
+  and the fail-fast-before-object-storage rule against the live write service.
 - `cellc install`/`cellc update` now query
   `api.registry.cellscript.dev` by default, select only accepted public
   statuses, then download the version's immutable Registry snapshot and verify
@@ -239,6 +242,11 @@ Production-readiness evidence currently proves:
 - the daily systemd backup produces checksum-verified Postgres and object-store
   archives, and both archive formats pass non-destructive restore inspection;
 - the website serves the live Registry and contains no Coming Soon surface.
+- a cryptographically valid WebAuthn-shaped P-256 fixture completes capability
+  registration, explicit namespace claim, signed publish, idempotent replay,
+  API/static/snapshot reads, and a fresh-directory install/check/build against
+  production; this proves deployment mechanics but is not publisher-owned
+  JoyID evidence.
 
 The remaining release checkpoint is intentionally narrower but real: complete
 the positive publisher-owned JoyID flow and install its first accepted source
 
@@ -240,9 +240,12 @@ Cloudflare bindings/secrets.
 it is safe; already-applied migration files are skipped.
 
 `GET /health` is a process liveness check. `GET /ready` performs live store and
-object-adapter checks and returns `503` until every required dependency and the
-admin token are ready. `NAMESPACE_CLAIM_COOLDOWN_SECONDS` defaults to `3600`;
-lower it only for controlled staging tests.
+object-adapter checks, including write access to both managed
+`source-snapshots` and `packages` prefixes, and returns `503` until every
+required dependency and the admin token are ready. The production volume
+initializer repairs ownership and directory/file modes recursively before the
+API starts. `NAMESPACE_CLAIM_COOLDOWN_SECONDS` defaults to `3600`; lower it
+only for controlled staging tests.
 
 ## Admin Governance Boundary
 
@@ -288,11 +291,16 @@ is submitted to the write API:
 cellc auth capability create --principal-id <principal_id> --scope publish:ns/pkg --expires 90d --json > capability-payload.json
 # Sign capability-payload.json with the production JoyID path exposed through CCC.
 cellc auth capability submit --payload capability-payload.json --joyid-signature joyid-signature.json
+cellc auth namespace claim --namespace ns --payload capability-payload.json --joyid-signature joyid-signature.json
 ```
 
 The registry submit page can sign the same payload through the CCC JoyID CKB
 signer and submit it directly to `/v1/capabilities`. The signed response can
 also be copied as `joyid-signature.json` for the CLI submit path.
+The separate **Claim namespace** action, or `cellc auth namespace claim`, sends
+the same signed authorisation to `/v1/namespaces/claim`. A first publish is
+intentionally rejected until that claim is active; reserved namespaces may
+remain pending for administrator review.
 
 The submit page derives the preferred `principal_id` from the connected JoyID
 signer and exposes a copy action. The API verifies that the JoyID signature's
@@ -351,9 +359,11 @@ request. It can be pinned with `--idempotency-key` or
 same request.
 
 If publish admission fails before the package version is accepted, the write API
-releases the matching `processing` idempotency reservation. The signed publish
-nonce may already have been consumed, so a later retry with the same CI retry key
-must use a freshly generated publish payload and capability signature.
+releases both the matching `processing` idempotency reservation and the nonce
+record created by that request. The exact signed request can therefore be
+retried safely. Package, snapshot, version, capability-use, acceptance-audit,
+and completed-idempotency records commit in one database transaction; immutable
+object writes happen before that transaction and may be repeated safely.
 
 Successful publish returns a direct static read URL shaped as:
 
 
@@ -28,7 +28,7 @@ services:
 
   object-store-init:
     image: alpine:3.22
-    command: ["sh", "-c", "chown -R 1000:101 /objects && chmod 2750 /objects"]
+    command: ["sh", "-c", "chown -R 1000:101 /objects && find /objects -type d -exec chmod 2750 '{}' ';' && find /objects -type f -exec chmod 0640 '{}' ';'"]
     volumes:
       - registry-objects:/objects
     restart: "no"