3f2e40f07d
Stable archives live under the attempt ref, but channel records only carried releaseTag, so the protected prefix check rejected the bytes the pipeline actually writes. An optional archiveRef on the request names the attempt archive; validators and readers use it for the releases/tag/ prefix and fall back to releaseTag, which fails closed for stable records without it. Canary records never write the field.