# 1.1.0 user-state publication and recovery > Version: 1.1.0. Release requirements; implementation and delivery are recorded below. > [Verification status](/Riff/1-1-0/status). ## Independent files, atomic references The seven user-state logical files have independent generations. A small manifest references their accepted immutable objects. A publication may replace one file or several dependent files. Unchanged objects are reused; there is no common database generation. Under the selected root, use indexer/user-state with objects, manifests, CURRENT and PREVIOUS. Object and manifest names are 16-lowercase-hex XXH3 content IDs, not UUIDs. CURRENT/PREVIOUS are StatePointer FlatBuffers. Manifest IDs hash complete manifest bytes. File object IDs hash complete final file bytes, including defined padding. The file is not required to embed its own ID. Existing objects are reused after length and XXH3 checksum validation. No byte-comparison collision detection or separate XXH3 collision-resolution mechanism is required. ## Commit Serialize one coherent cut of RAM state and receipt prefixes. Assign each dirty file its next generation; assign that generation to its new history entries and perform retention. Validate all members, lengths, references and XXH3 checksums. Write immutable objects, force files and required directories, then write and force a new manifest. Durably preserve the old CURRENT as PREVIOUS before atomically replacing and syncing CURRENT. Only then emit SAVED. Cleanup failure cannot undo a committed publication. CURRENT and PREVIOUS retain their reachable objects; remove other abandoned/obsolete objects. Open read-only descriptors retain exact immutable bytes even after unlink. No scan, metadata or analysis publication clock controls this user-state scheduler. ## Recovery and root fences After selected-storage admission, validate CURRENT pointer, manifest, all member files and their semantic coherence. Fall back only to a validated PREVIOUS. Never adopt an unreferenced candidate by enumerating directories. Corruption differs from unreadable media, permission errors or disk full. Preserve damaged evidence and report unavailable state when neither accepted set is valid. Bootstrap waiting/reset and explicit relocation retain their existing gates. Drain/fence both processes, close mappings and copy the complete root under the established byte-faithful relocation transaction. Do not merge roots or create an internal replica. Recreate no user state because the catalog is being rebuilt. A new compatible store initializes all seven files at generation zero. Profile/history generations are independent of Cuetree and MDRG. If failure follows CURRENT replacement but precedes reply, read and validate the committed receipts before retry; never allocate a second generation just because an acknowledgement was lost. The storage-context identity is a 64-bit hash of its canonical admission/creation descriptor. It is distinct from the external source-volume UUID and is not synthesized as a new UUID. Runtime fences retain the actual admitted handle/session; an ID match alone cannot authorize a stale callback or a replacement root.