@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/standalone-recovery/core.ts

@@ -1,20 +1,37 @@
 import { assertRuntimePerformanceEvidence, measureRuntimePerformance, samePerformanceIdentity, type RuntimePerformanceDependencies, type RuntimePerformanceEvidence, type RuntimePerformanceIdentity } from './performance';
+import { runBoundedChild } from '../shared/bounded-child-supervisor';
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'crypto';
 import { spawn, spawnSync } from 'child_process';
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from 'fs';
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'fs';
 import { homedir, hostname } from 'os';
+import { createServer as createNetServer } from 'net';
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from 'path';
 import { assertStorageHeadroom } from '../shared/storage-capacity';
-import { resolveBunExecutable } from '../shared/process-environment';
-import { observeRuntimeStatus } from '../root/status';
+import { resolveBunExecutable, runtimeAuthorityFreeEnvironment } from '../shared/process-environment';
+import { backupControlPlaneDatabase } from '../control-plane/persistence/sqlite-store';
+import { measureReclaimablePath } from '../control-plane/lifecycle-retention-metrics';
+import { cleanupControllerReleaseHistory } from '../control-plane/release-retention';
+import { observeRuntimeStatus, readRuntimeStartupFailureEvidence } from '../root/status';
+import { reconcileStoppedRuntimeOwnership, terminateVerifiedRuntimeOwner, readRuntimeOwner } from '../root/ownership';
+import type { RuntimeOwnerRecord } from '../root/ownership';
 import {
   activeRuntimeEntrypoint,
   activeRuntimeLaunchSpec,
   ensureForgeRuntimeLaunchAgentContract,
   forgeRuntimeServicePaths,
   inspectForgeRuntimeLaunchAgentContract,
+  installForgeRuntimeService,
   readForgeRuntimeServiceConfig,
+  syncForgeRuntimeActiveEntrypoint,
+  uninstallForgeRuntimeService,
 } from '../root/service';
+import { removeRetiredCandidateExecutionLane } from '../root/runtime-lane';
+import {
+  inspectKnownGoodRecoveryBundle,
+  knownGoodRecoveryBundleRoot,
+  sha256FileBounded,
+  type KnownGoodRecoveryBundle,
+} from '../root/known-good-recovery';
 import { systemdUserUnitName, systemdUserUnitPath } from '../../cli/controller/systemd-user';
 import {
   openAiSecureTunnelConnectArgs,
@@ -24,14 +41,18 @@ import {
 } from '../../../adapters/mcp/tunnels/openai-secure-tunnel';
 import {
   renderPackageRuntimeSystemdUserService,
+  systemdRuntimeInstallCommands,
   writePackageRuntimeSystemdUserService,
 } from '../root/package-runtime-service';
 import { loadRuntimeReleaseManifest } from '../root/release-manifest';
-import { assertRuntimeReleaseExecutionCanaries, assertRuntimeReleaseFiles, stageRuntimeReleaseFromCandidateSource, type RuntimeReleaseExecutionCanaryDependencies, type StagedRuntimeRelease } from '../root/release-materialize';
+import { assertRuntimeReleaseExecutionCanaries, assertRuntimeReleaseFiles, promotePortableRuntimeRelease, runtimeReleaseTreeSha256, stageRuntimeReleaseFromCandidateSource, withRuntimeReleaseSourceSnapshot, type RuntimeReleaseExecutionCanaryDependencies, type StagedRuntimeRelease } from '../root/release-materialize';
 import {
+  prepareRuntimeReleaseDatabaseBackup,
   publishRuntimeRelease,
   readRuntimeReleaseAuthority,
-  rollbackRuntimeRelease,
+  reconcileFailedRuntimeReleaseActivationAuthority,
+  rollbackRuntimeReleaseWithResult,
+  type RuntimeDatabaseRollbackDisposition,
   type RuntimePublishedRelease,
   type RuntimeReleaseAuthority,
 } from '../root/release-store';
@@ -39,16 +60,34 @@ import type { RuntimeReleaseManifest } from '../root/types';
 import { ensurePackageConnectorService, packageConnectorAuthMode, packageConnectorServicePaths, type PackageConnectorReleaseBinding } from '../root/package-connector-service';
 import { createRecoveryHttpTransport, type RecoveryHttpTransport } from './http-transport';
 import { observeRecoveryWatchdogHealth } from './watchdog-heartbeat';
-import { RECOVERY_GATEWAY_LABEL, RECOVERY_WATCHDOG_LABEL } from './service-labels';
+import { RECOVERY_DAEMON_LABEL } from './service-labels';
+import { resolveWorkflowSupervisorForgeHome, workflowSupervisorSocketPath } from '../../../supervisor/paths';
+import { getWorkflowSupervisorContinuationProof } from '../../../supervisor/client';
+import type { WorkflowSupervisorContinuationProof } from '../../../supervisor/types';
+import { reconcileStoppedWorkflowSupervisorSocket } from '../../../supervisor/server';
 import {
   migrateStoppedRepoLocalControllerHomeStorage,
   repoLocalControllerHomeStorageNeedsMigration,
   rollbackStoppedRepoLocalControllerHomeStorage,
   type ControllerHomeStorageMigration,
 } from '../../cli/repositories/controller-home';
-import { readCurrentRecoveryRelease } from './release';
+import { readCurrentRecoveryRelease, type RecoveryRuntimeRole } from './release';
 import { recoveryOperationLockPath } from './operation-lock';
 import { RECOVERY_MUTATION_IDENTITY_FIELDS, type RecoveryMutationIdentityArguments } from './mutation-identity-contract';
+import { createCandidateExecutionLane, readStableExecutionLane } from '../root/runtime-lane';
+import {
+  advanceReleaseSession,
+  createReleaseSession,
+  listCompleteReleaseSessions,
+  readReleaseSession,
+  recordReleaseSessionTransaction,
+  releaseSessionCandidateIsRetired,
+  releaseSessionIsSoakingPredecessorOfStable,
+  releaseSessionIsSoakingSupersededByStableAuthority,
+  type ReleaseSession,
+  type ReleaseSessionCandidateRelease,
+  type ReleaseSessionStableRelease,
+} from '../release/release-session';
 
 /** Standalone recovery reads only canonical Runtime observation and whole-release authority. */
 interface PublicTunnelRecoveryPolicy {
@@ -125,9 +164,24 @@ export interface SystemdPrimaryConnectorServiceConfig extends PrimaryConnectorRe
 
 export type PrimaryConnectorServiceConfig = LaunchdPrimaryConnectorServiceConfig | SystemdPrimaryConnectorServiceConfig;
 
+export type RecoveryInstallProfile = 'manual' | 'gateway' | 'self-healing';
+
+export function normalizeRecoveryInstallProfile(value: unknown, fallback: RecoveryInstallProfile = 'self-healing'): RecoveryInstallProfile {
+  if (value === undefined || value === null || value === '') return fallback;
+  if (value === 'manual' || value === 'gateway' || value === 'self-healing') return value;
+  throw new Error(`RECOVERY_INSTALL_PROFILE_INVALID: ${String(value)}`);
+}
+
+export function recoveryInstallProfileRoles(profile: RecoveryInstallProfile): RecoveryRuntimeRole[] {
+  if (profile === 'manual') return [];
+  return ['daemon'];
+}
+
 export interface RecoveryConfig {
   schemaVersion: 1;
   controllerHome: string;
+  /** Persistent Recovery role selection. Legacy configs default to self-healing. */
+  installProfile: RecoveryInstallProfile;
   publicMcpUrl?: string;
   recoveryPublicUrl?: string;
   recoveryTunnelService?: RecoveryTunnelServiceConfig;
@@ -220,28 +274,46 @@ interface ReleaseEvidence {
   manifestSha256: string;
   workerProtocolVersion: number;
   controllerHome?: string;
+  sourceRepositoryId?: string;
   releaseAuthorityRevision?: number;
   releaseFencingTokenSha256?: string;
   attestedAt?: string;
+  pinnedAt?: string;
   performance?: RuntimePerformanceEvidence;
+  recoveryBundle?: KnownGoodRecoveryBundle;
 }
 
 interface KnownGoodStore {
-  schemaVersion: 1;
+  schemaVersion: 1 | 2;
   releases: ReleaseEvidence[];
   updatedAt: string;
 }
 
+interface RuntimePinStore {
+  schemaVersion: 1;
+  release: ReleaseEvidence;
+  updatedAt: string;
+}
+
 export type RecoveryMutationAction =
   | 'attest_known_good'
   | 'rollback_previous'
   | 'restart_primary_runtime'
   | 'recover_primary_runtime'
   | 'activate_runtime_release'
+  | 'pin_runtime_release'
+  | 'unpin_runtime_release'
+  | 'activate_pinned_runtime_release'
   | 'stage_and_activate_runtime_release'
+  | 'release_session_prepare'
+  | 'release_session_static_verify'
+  | 'release_session_candidate_boot'
+  | 'release_session_cutover'
+  | 'release_session_cancel'
+  | 'release_session_rollback'
+  | 'release_session_known_good'
   | 'restart_primary_connector'
   | 'restart_recovery_gateway'
-  | 'restart_recovery_watchdog'
   | 'repair_public_tunnel';
 
 interface RecoveryLock {
@@ -275,6 +347,26 @@ export interface VerifyStableRuntimeOptions extends RuntimeReleaseExecutionCanar
   probeMcpProtocol?: boolean;
 }
 
+/**
+ * Remote tunnel control-plane lookup is weaker evidence than the live data plane.
+ * Once the configured tunnel is locally healthy/ready with matching identities and
+ * the public MCP protocol succeeds end-to-end, a degraded/unknown control-plane
+ * lookup remains diagnostic instead of vetoing whole-Runtime verification.
+ * Any local health, readiness, identity, endpoint, or MCP failure still gates.
+ */
+export function isPrimaryTunnelControlPlaneOnlyDegradation(
+  probe: VerifyResult['probes'][string] | undefined,
+  mcpProtocolHealthy: boolean,
+): boolean {
+  if (!mcpProtocolHealthy || !probe || probe.ok) return false;
+  const observed = probe.value as Partial<OpenAiSecureTunnelRuntimeObservation> | undefined;
+  return observed?.healthy === true
+    && observed.ready === true
+    && observed.tunnelMatches === true
+    && observed.endpointMatches === true
+    && (observed.controlPlaneState === 'degraded' || observed.controlPlaneState === 'unknown');
+}
+
 /** Bounded, release-scoped explanation for a failed watchdog verification. */
 export interface RecoveryWatchdogDiagnosticEvidence {
   fingerprint: string;
@@ -370,6 +462,8 @@ export interface ConfiguredRuntimeActivationResult {
   noOp?: boolean;
   detail: string;
   staged?: StagedRuntimeRelease;
+  releaseSession?: ReleaseSession;
+  /** Legacy/home-bound recovery activation only. Fresh portable source candidates never set this during preparation. */
   activation?: RuntimeReleaseActivationResult;
 }
 
@@ -415,6 +509,7 @@ export function defaultPrimaryRuntimeServiceConfig(platform: NodeJS.Platform = p
 
 const DEFAULT_CONFIG: Omit<RecoveryConfig, 'controllerHome'> = {
   schemaVersion: 1,
+  installProfile: 'self-healing',
   readOnlyTool: { name: STABLE_RECOVERY_READ_ONLY_TOOL.name, arguments: { ...STABLE_RECOVERY_READ_ONLY_TOOL.arguments } },
   primaryRuntimeService: defaultPrimaryRuntimeServiceConfig(),
 };
@@ -439,6 +534,7 @@ function writeJson(path: string, value: unknown): void {
 
 function recoveryRoot(config: RecoveryConfig): string { return join(resolve(config.controllerHome), 'recovery'); }
 function statePath(config: RecoveryConfig): string { return join(recoveryRoot(config), 'state', 'known-good.json'); }
+function runtimePinPath(config: RecoveryConfig): string { return join(recoveryRoot(config), 'state', 'runtime-pin.json'); }
 function lockPath(config: RecoveryConfig): string { return recoveryOperationLockPath(config.controllerHome); }
 function auditPath(config: RecoveryConfig): string { return join(recoveryRoot(config), 'audit', 'recovery.jsonl'); }
 function watchdogDiagnosticPath(config: RecoveryConfig): string { return join(recoveryRoot(config), 'state', 'watchdog-diagnostics.json'); }
@@ -488,6 +584,7 @@ export function loadRecoveryConfig(controllerHome: string, explicit?: string): R
     ...DEFAULT_CONFIG,
     schemaVersion: 1,
     controllerHome: resolve(typeof loaded.controllerHome === 'string' ? loaded.controllerHome : controllerHome),
+    installProfile: normalizeRecoveryInstallProfile(loaded.installProfile, 'self-healing'),
     ...(typeof loaded.publicMcpUrl === 'string' ? { publicMcpUrl: loaded.publicMcpUrl } : {}),
     ...(typeof loaded.recoveryPublicUrl === 'string' ? { recoveryPublicUrl: loaded.recoveryPublicUrl } : {}),
     ...(loaded.recoveryTunnelService ? { recoveryTunnelService: loaded.recoveryTunnelService } : {}),
@@ -550,33 +647,193 @@ function previousAuthorityRelease(config: RecoveryConfig): ReleaseEvidence | und
   return releaseEvidence(config.controllerHome, authority?.previous, authority);
 }
 
-function knownGoodEvidence(config: RecoveryConfig, entry: ReleaseEvidence | undefined): ReleaseEvidence | undefined {
+function sameReleaseIdentity(left: ReleaseEvidence, right: ReleaseEvidence): boolean {
+  return left.path === right.path
+    && left.revision === right.revision
+    && left.artifactIdentity === right.artifactIdentity
+    && left.manifestSha256 === right.manifestSha256
+    && left.workerProtocolVersion === right.workerProtocolVersion;
+}
+
+function knownGoodAttestationEvidence(config: RecoveryConfig, entry: ReleaseEvidence | undefined): ReleaseEvidence | undefined {
   if (!entry || !entry.attestedAt || !entry.releaseFencingTokenSha256 || typeof entry.controllerHome !== 'string') return undefined;
+  // Legacy metadata-only attestations are audit history, not recoverable authority.
+  // The cheap tier requires durable bundle identity but never reads bundle contents.
+  if (!entry.recoveryBundle || entry.recoveryBundle.schemaVersion !== 1) return undefined;
   if (resolve(entry.controllerHome) !== resolve(config.controllerHome)) return undefined;
   const authority = releaseAuthority(config);
   const candidates = [
     releaseEvidence(config.controllerHome, authority?.active, authority),
     releaseEvidence(config.controllerHome, authority?.previous, authority),
   ].filter((item): item is ReleaseEvidence => Boolean(item));
-  const matched = candidates.find((release) =>
-    release.path === entry.path
-    && release.revision === entry.revision
-    && release.artifactIdentity === entry.artifactIdentity
-    && release.manifestSha256 === entry.manifestSha256
-    && release.workerProtocolVersion === entry.workerProtocolVersion,
-  );
-  return matched ? entry : undefined;
+  return candidates.some((release) => sameReleaseIdentity(release, entry)) ? entry : undefined;
+}
+
+function knownGoodEvidence(config: RecoveryConfig, entry: ReleaseEvidence | undefined): ReleaseEvidence | undefined {
+  const attested = knownGoodAttestationEvidence(config, entry);
+  if (!attested) return undefined;
+  try { inspectKnownGoodRecoveryBundle(config.controllerHome, attested); }
+  catch { return undefined; }
+  return attested;
 }
 
 function knownGood(config: RecoveryConfig): KnownGoodStore {
   return json<KnownGoodStore>(statePath(config)) ?? { schemaVersion: 1, releases: [], updatedAt: new Date(0).toISOString() };
 }
 
+function inspectKnownGoodRecoverability(config: RecoveryConfig): {
+  available: ReleaseEvidence[];
+  unavailable: Array<{ revision: string; path: string; reason: string }>;
+} {
+  const available: ReleaseEvidence[] = [];
+  const unavailable: Array<{ revision: string; path: string; reason: string }> = [];
+  const store = knownGood(config);
+  // Pre-bundle records remain audit history only. They are deliberately
+  // neither usable Recovery authority nor a readiness failure for an
+  // otherwise healthy Runtime, because no action can make them restorable.
+  if (store.schemaVersion !== 2) return { available, unavailable };
+  const releasesRoot = resolve(config.controllerHome, 'runtime', 'releases');
+  const authority = releaseAuthority(config);
+  const rollbackReleasePaths = new Set<string>();
+  if (authority) {
+    rollbackReleasePaths.add(resolve(dirname(authority.active.manifestPath)));
+    if (authority.previous) rollbackReleasePaths.add(resolve(dirname(authority.previous.manifestPath)));
+  }
+  for (const entry of store.releases) {
+    if (!rollbackReleasePaths.has(resolve(dirname(entry.path)))) continue;
+    try {
+      const inspected = inspectKnownGoodRecoveryBundle(config.controllerHome, entry);
+      if (dirname(inspected.releaseRoot) !== releasesRoot) throw new Error('known-good path is outside Runtime release authority');
+      available.push(entry);
+    } catch (error) {
+      unavailable.push({
+        revision: entry.revision,
+        path: entry.path,
+        reason: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+  return { available, unavailable };
+}
+
+function matchingKnownGoodAttestation(config: RecoveryConfig, release: ReleaseEvidence | undefined): ReleaseEvidence | undefined {
+  if (!release) return undefined;
+  return knownGoodAttestationEvidence(config, knownGood(config).releases.find((entry) => sameReleaseIdentity(entry, release)));
+}
+
 function matchingKnownGood(config: RecoveryConfig, release: ReleaseEvidence | undefined): ReleaseEvidence | undefined {
   if (!release) return undefined;
-  return knownGoodEvidence(config, knownGood(config).releases.find((entry) =>
-    entry.revision === release.revision && entry.manifestSha256 === release.manifestSha256 && entry.path === release.path,
-  ));
+  return knownGoodEvidence(config, knownGood(config).releases.find((entry) => sameReleaseIdentity(entry, release)));
+}
+
+function sameReleaseEvidenceIdentity(left: ReleaseEvidence | undefined, right: ReleaseEvidence | undefined): boolean {
+  return Boolean(
+    left
+    && right
+    && left.path === right.path
+    && left.revision === right.revision
+    && left.artifactIdentity === right.artifactIdentity
+    && left.manifestSha256 === right.manifestSha256
+    && left.workerProtocolVersion === right.workerProtocolVersion,
+  );
+}
+
+function liveRuntimeOwnsRelease(config: RecoveryConfig, release: ReleaseEvidence): boolean {
+  const active = activeAuthorityRelease(config);
+  const observed = observeRuntimeStatus(config.controllerHome);
+  const snapshot = observed.snapshot;
+  return Boolean(
+    sameReleaseEvidenceIdentity(active, release)
+    && observed.running
+    && observed.ready
+    && !observed.stale
+    && snapshot
+    && snapshot.releaseId === release.revision
+    && snapshot.artifactIdentity === release.artifactIdentity,
+  );
+}
+
+function runtimePin(config: RecoveryConfig): RuntimePinStore | undefined {
+  const path = runtimePinPath(config);
+  if (!existsSync(path)) return undefined;
+  let parsed: RuntimePinStore;
+  try { parsed = JSON.parse(readFileSync(path, 'utf8')) as RuntimePinStore; }
+  catch (error) { throw new Error(`RUNTIME_PIN_AUTHORITY_INVALID: ${error instanceof Error ? error.message : String(error)}`); }
+  const release = parsed?.release;
+  if (parsed?.schemaVersion !== 1 || !release || !release.revision?.trim() || !release.path?.trim() || !release.artifactIdentity?.trim() || !release.manifestSha256?.trim() || !Number.isInteger(release.workerProtocolVersion)) {
+    throw new Error('RUNTIME_PIN_AUTHORITY_INVALID');
+  }
+  const releasesRoot = resolve(config.controllerHome, 'runtime', 'releases');
+  const manifestPath = resolve(release.path);
+  const releaseRoot = dirname(manifestPath);
+  if (basename(manifestPath) !== 'manifest.json' || basename(releaseRoot) !== release.revision || dirname(releaseRoot) !== releasesRoot) {
+    throw new Error('RUNTIME_PIN_AUTHORITY_PATH_INVALID');
+  }
+  return parsed;
+}
+
+function releaseEvidenceForPin(
+  config: RecoveryConfig,
+  candidate: { manifest: RuntimeReleaseManifest; manifestPath: string },
+): ReleaseEvidence {
+  const releasesRoot = resolve(config.controllerHome, 'runtime', 'releases');
+  const releaseRoot = dirname(resolve(candidate.manifestPath));
+  if (!existsSync(releasesRoot) || dirname(realpathSync(releaseRoot)) !== realpathSync(releasesRoot)) {
+    throw new Error('RUNTIME_PIN_RELEASE_OUTSIDE_CONTROLLER_RUNTIME_ROOT');
+  }
+  const expectedRepositoryId = config.primaryRuntimeSourceRepositoryId?.trim();
+  if (expectedRepositoryId && candidate.manifest.sourceRepositoryId !== expectedRepositoryId) {
+    throw new Error(`RUNTIME_PIN_SOURCE_REPOSITORY_MISMATCH: expected ${expectedRepositoryId}, got ${candidate.manifest.sourceRepositoryId ?? 'missing'}`);
+  }
+  return {
+    path: candidate.manifestPath,
+    revision: candidate.manifest.releaseId,
+    artifactIdentity: candidate.manifest.artifactIdentity,
+    manifestSha256: createHash('sha256').update(readFileSync(candidate.manifestPath)).digest('hex'),
+    workerProtocolVersion: candidate.manifest.workerProtocolVersion,
+    controllerHome: resolve(config.controllerHome),
+    ...(candidate.manifest.sourceRepositoryId ? { sourceRepositoryId: candidate.manifest.sourceRepositoryId } : {}),
+    pinnedAt: new Date().toISOString(),
+  };
+}
+
+export async function pinRuntimeRelease(config: RecoveryConfig, candidateManifestPath: string, requestId?: string): Promise<Record<string, unknown>> {
+  let candidate: { manifest: RuntimeReleaseManifest; releaseRoot: string; manifestPath: string };
+  try { candidate = validateRuntimeReleaseCandidate(config, candidateManifestPath); }
+  catch (error) { return { ok: false, attempted: false, noOp: true, detail: error instanceof Error ? error.message : String(error) }; }
+  if (candidate.manifest.deploymentScope === 'portable') {
+    return {
+      ok: false,
+      attempted: false,
+      noOp: true,
+      detail: 'RUNTIME_PIN_PORTABLE_RELEASE_FORBIDDEN: portable source candidates require a verified Recovery ReleaseSession',
+    };
+  }
+  let evidence: ReleaseEvidence;
+  try { evidence = releaseEvidenceForPin(config, candidate); }
+  catch (error) { return { ok: false, attempted: false, noOp: true, detail: error instanceof Error ? error.message : String(error) }; }
+  const locked = await withLock(config, { action: 'pin_runtime_release', requestId }, async () => {
+    const current = runtimePin(config);
+    if (current?.release.revision === evidence.revision && current.release.manifestSha256 === evidence.manifestSha256) {
+      return { ok: true, attempted: false, noOp: true, detail: 'requested Runtime release is already pinned', pinned: current.release };
+    }
+    const store: RuntimePinStore = { schemaVersion: 1, release: evidence, updatedAt: new Date().toISOString() };
+    writeJson(runtimePinPath(config), store);
+    audit(config, 'runtime_release_pinned', { requestId, revision: evidence.revision, artifactIdentity: evidence.artifactIdentity });
+    return { ok: true, attempted: true, detail: 'Runtime release pinned for retention and explicit Runtime-only activation', pinned: evidence };
+  });
+  return locked.acquired ? locked.value : { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner) };
+}
+
+export async function unpinRuntimeRelease(config: RecoveryConfig, requestId?: string): Promise<Record<string, unknown>> {
+  const locked = await withLock(config, { action: 'unpin_runtime_release', requestId }, async () => {
+    const current = runtimePin(config);
+    if (!current) return { ok: true, attempted: false, noOp: true, detail: 'no Runtime release is pinned' };
+    rmSync(runtimePinPath(config), { force: true });
+    audit(config, 'runtime_release_unpinned', { requestId, revision: current.release.revision, artifactIdentity: current.release.artifactIdentity });
+    return { ok: true, attempted: true, detail: 'Runtime release pin removed', unpinned: current.release };
+  });
+  return locked.acquired ? locked.value : { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner) };
 }
 
 
@@ -586,6 +843,75 @@ function audit(config: RecoveryConfig, event: string, detail: Record<string, unk
   writeFileSync(auditPath(config), `${line}\n`, { encoding: 'utf8', mode: 0o600, flag: 'a' });
 }
 
+export interface RecoveryHistoryEvent {
+  at: string;
+  event: string;
+  ok?: boolean;
+}
+
+const RECOVERY_HISTORY_MAX_EVENTS = 50;
+const RECOVERY_HISTORY_MAX_BYTES = 256 * 1024;
+
+/**
+ * Bounded read-only projection of the canonical Recovery audit. The projection
+ * intentionally omits arbitrary detail payloads, filesystem paths, request ids,
+ * service targets, and other mechanics that the desktop does not need.
+ */
+export function listRecoveryHistory(
+  config: RecoveryConfig,
+  requestedLimit = 20,
+): { events: RecoveryHistoryEvent[]; bounded: true; truncated: boolean } {
+  const limit = Number.isFinite(requestedLimit)
+    ? Math.max(1, Math.min(Math.trunc(requestedLimit), RECOVERY_HISTORY_MAX_EVENTS))
+    : 20;
+  const path = auditPath(config);
+  if (!existsSync(path)) return { events: [], bounded: true, truncated: false };
+
+  const size = statSync(path).size;
+  if (size <= 0) return { events: [], bounded: true, truncated: false };
+  const start = Math.max(0, size - RECOVERY_HISTORY_MAX_BYTES);
+  const length = size - start;
+  const buffer = Buffer.alloc(length);
+  const fd = openSync(path, 'r');
+  let read = 0;
+  try {
+    while (read < length) {
+      const count = readSync(fd, buffer, read, length - read, start + read);
+      if (count <= 0) break;
+      read += count;
+    }
+  } finally {
+    closeSync(fd);
+  }
+
+  let text = buffer.subarray(0, read).toString('utf8');
+  if (start > 0) {
+    const firstNewline = text.indexOf('\n');
+    text = firstNewline >= 0 ? text.slice(firstNewline + 1) : '';
+  }
+  const parsed: RecoveryHistoryEvent[] = [];
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    try {
+      const value = JSON.parse(trimmed) as { at?: unknown; event?: unknown; detail?: unknown };
+      if (typeof value.at !== 'string' || typeof value.event !== 'string') continue;
+      const detail = value.detail && typeof value.detail === 'object' && !Array.isArray(value.detail)
+        ? value.detail as Record<string, unknown>
+        : undefined;
+      parsed.push({
+        at: value.at,
+        event: value.event,
+        ...(typeof detail?.ok === 'boolean' ? { ok: detail.ok } : {}),
+      });
+    } catch {
+      // A partially written final line is not a durable audit event yet.
+    }
+  }
+  const truncated = start > 0 || parsed.length > limit;
+  return { events: parsed.slice(-limit).reverse(), bounded: true, truncated };
+}
+
 const WATCHDOG_DIAGNOSTIC_LIMIT = 32;
 
 function watchdogProbeComponent(name: string): RecoveryWatchdogDiagnosticEvidence['components'][number] {
@@ -649,7 +975,7 @@ function recoveryLockOwnerAlive(lock: RecoveryLock): boolean {
   if (!pidAlive(lock.pid)) return false;
   if (!lock.processStartTime) return true;
   const observed = processStartTime(lock.pid);
-  return observed === undefined || observed === lock.processStartTime;
+  return observed === lock.processStartTime;
 }
 
 function recoveryLockOwnerAttributable(owner: RecoveryLock): boolean {
@@ -907,7 +1233,16 @@ function canonicalRuntimeSafeForTargetedConnectorRecovery(verified: VerifyResult
 }
 
 function mainToken(config: RecoveryConfig): string | undefined {
-  const candidate = config.mainMcpTokenFile ?? join(config.controllerHome, 'mcp', 'mcp.tokens.json');
+  const explicit = config.mainMcpTokenFile?.trim();
+  const candidate = explicit || join(config.controllerHome, 'mcp', 'mcp.tokens.json');
+  if (explicit) {
+    try {
+      const raw = readFileSync(candidate, 'utf8').trim();
+      if (raw.length >= 24 && !raw.startsWith('{')) return raw;
+    } catch {
+      return undefined;
+    }
+  }
   const parsed = json<{ bearerToken?: unknown }>(candidate);
   return typeof parsed?.bearerToken === 'string' && parsed.bearerToken.length >= 24 ? parsed.bearerToken : undefined;
 }
@@ -1003,6 +1338,20 @@ function runtimeHealthEndpoint(endpoint: string): string {
   return url.toString();
 }
 
+/**
+ * tunnel-client materialises its own state directory relative to the process
+ * working directory. Persistent Forge services run under launchd/systemd with a
+ * read-only working directory, so a Forge-owned tunnel reconnect must run from a
+ * writable Forge-managed directory. Otherwise the reconnect fails with
+ * `mkdir .tunnel-client: read-only file system`, the dedicated Recovery
+ * transport can never be repaired, and the Recovery connector stays dark.
+ */
+function tunnelClientWorkingDirectory(controllerHome: string): string {
+  const directory = join(resolve(controllerHome), 'tmp', 'tunnel-client');
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
+  return directory;
+}
+
 async function observeOpenAiTunnelRuntime(
   configured: OpenAiSecureTunnelServiceConfig,
   runCommand: CommandRunner = command,
@@ -1013,6 +1362,8 @@ async function observeOpenAiTunnelRuntime(
   } catch (error) {
     return {
       ok: false, running: false, healthy: false, ready: false, tunnelMatches: false, endpointMatches: false,
+      controlPlaneState: 'unknown',
+      controlPlaneDetail: 'tunnel runtime configuration could not be observed',
       alias: configured.alias, tunnelId: configured.tunnelId,
       detail: error instanceof Error ? error.message : 'OpenAI tunnel runtime configuration is invalid',
     };
@@ -1023,6 +1374,8 @@ async function observeOpenAiTunnelRuntime(
     if (local) return local;
     return {
       ok: false, running: false, healthy: false, ready: false, tunnelMatches: false, endpointMatches: false,
+      controlPlaneState: 'unknown',
+      controlPlaneDetail: 'tunnel-client status produced no remote control-plane evidence',
       alias: configured.alias, tunnelId: configured.tunnelId,
       detail: status.stderr.trim() || 'OpenAI tunnel runtime status is unavailable',
     };
@@ -1069,7 +1422,11 @@ export async function observeOpenAiTunnelLocalHealthFallback(
     try { return (await request(url.toString(), { signal: controller.signal })).ok; } catch { return false; } finally { clearTimeout(timer); }
   };
   const [healthy, ready] = await Promise.all([probe('/healthz'), probe('/readyz')]);
-  const ok = healthy && ready && identityMatches && endpointMatches;
+  const localReady = healthy && ready && identityMatches && endpointMatches;
+  // Loopback health proves only that the local tunnel process and MCP binding are
+  // alive. It must never stand in for the remote OpenAI control plane when the
+  // status command itself could not establish that path.
+  const ok = false;
   const failures: string[] = [];
   if (!identityMatches) failures.push('profile tunnel id does not match');
   if (!endpointMatches) failures.push('profile MCP endpoint does not match');
@@ -1082,11 +1439,13 @@ export async function observeOpenAiTunnelLocalHealthFallback(
     ready,
     tunnelMatches: identityMatches,
     endpointMatches,
+    controlPlaneState: 'unknown',
+    controlPlaneDetail: 'tunnel-client status was unavailable; only loopback health was observed',
     alias: configured.alias,
     tunnelId: configured.tunnelId,
     ...(identityMatches ? { observedTunnelId: configured.tunnelId } : {}),
-    detail: ok
-      ? `managed runtime ${configured.alias} is locally healthy and ready for ${configured.tunnelId} (status command unavailable)`
+    detail: localReady
+      ? `managed runtime ${configured.alias} is locally healthy and ready for ${configured.tunnelId}, but the OpenAI control plane is unverified because status is unavailable`
       : failures.join('; ') || 'OpenAI tunnel local health fallback failed',
     profilePath,
   };
@@ -1104,11 +1463,22 @@ async function observeOpenAiRecoveryTunnel(
 async function ensureOpenAiTunnelRuntimeStarted(
   configured: OpenAiSecureTunnelServiceConfig,
   runCommand: CommandRunner = command,
+  workingDirectory?: string,
 ): Promise<{ ok: boolean; attempted: boolean; noOp?: boolean; detail: string; serviceLabel: string; serviceTarget: string }> {
   const serviceLabel = configured.alias;
   const serviceTarget = `tunnel-client:${configured.alias}`;
   const observed = await observeOpenAiTunnelRuntime(configured, runCommand);
   if (observed.ok) return { ok: true, attempted: false, noOp: true, detail: observed.detail, serviceLabel, serviceTarget };
+  if (observed.healthy && observed.ready && observed.tunnelMatches && observed.endpointMatches && observed.controlPlaneState !== 'ready') {
+    return {
+      ok: false,
+      attempted: false,
+      noOp: true,
+      detail: `OpenAI Secure MCP Tunnel runtime ${configured.alias} is locally ready but its remote control plane is ${observed.controlPlaneState}; refusing a local reconnect for an upstream transport failure: ${observed.controlPlaneDetail}`,
+      serviceLabel,
+      serviceTarget,
+    };
+  }
   if (observed.observedTunnelId && !observed.tunnelMatches) {
     return { ok: false, attempted: false, noOp: true, detail: `OpenAI tunnel alias ${configured.alias} is already bound to a different tunnel id`, serviceLabel, serviceTarget };
   }
@@ -1129,7 +1499,7 @@ async function ensureOpenAiTunnelRuntimeStarted(
   } catch (error) {
     return { ok: false, attempted: false, noOp: true, detail: error instanceof Error ? error.message : 'OpenAI tunnel runtime configuration is invalid', serviceLabel, serviceTarget };
   }
-  const connected = await runCommand('tunnel-client', args, Math.max(30_000, configured.postRestartVerifyTimeoutMs ?? 20_000));
+  const connected = await runCommand('tunnel-client', args, Math.max(30_000, configured.postRestartVerifyTimeoutMs ?? 20_000), workingDirectory ? { cwd: workingDirectory } : {});
   return connected.ok
     ? { ok: true, attempted: true, detail: `OpenAI Secure MCP Tunnel runtime ${configured.alias} connect dispatched`, serviceLabel, serviceTarget }
     : { ok: false, attempted: true, detail: `OpenAI Secure MCP Tunnel runtime connect failed: ${connected.stderr || connected.stdout || connected.status}`, serviceLabel, serviceTarget };
@@ -1143,6 +1513,140 @@ async function probeOpenAiRecoveryTunnel(
   return observed ? { ok: observed.ok, detail: observed.detail, value: observed } : undefined;
 }
 
+function openAiTunnelObservationFromProbe(
+  probe: { value?: unknown } | undefined,
+): OpenAiSecureTunnelRuntimeObservation | undefined {
+  const value = probe?.value;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const observed = value as Partial<OpenAiSecureTunnelRuntimeObservation>;
+  if (
+    typeof observed.alias !== 'string'
+    || typeof observed.tunnelId !== 'string'
+    || typeof observed.healthy !== 'boolean'
+    || typeof observed.ready !== 'boolean'
+    || typeof observed.tunnelMatches !== 'boolean'
+    || typeof observed.endpointMatches !== 'boolean'
+    || !['ready', 'degraded', 'unknown'].includes(String(observed.controlPlaneState))
+  ) return undefined;
+  return observed as OpenAiSecureTunnelRuntimeObservation;
+}
+
+function isUpstreamOpenAiControlPlaneIncident(observed: OpenAiSecureTunnelRuntimeObservation | undefined): boolean {
+  return Boolean(
+    observed
+    && observed.healthy
+    && observed.ready
+    && observed.tunnelMatches
+    && observed.endpointMatches
+    && observed.controlPlaneState !== 'ready'
+  );
+}
+
+async function probeOpenAiApiReachability(): Promise<{ ok: boolean; detail: string; status?: number }> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort('RECOVERY_OPENAI_API_REACHABILITY_TIMEOUT'), 4_000);
+  try {
+    const response = await fetch('https://api.openai.com/v1/models', {
+      method: 'GET',
+      headers: { accept: 'application/json' },
+      signal: controller.signal,
+    });
+    return {
+      ok: true,
+      status: response.status,
+      detail: `api.openai.com returned HTTP ${response.status}; DNS/TCP/TLS/HTTP path is reachable`,
+    };
+  } catch (error) {
+    const cause = error instanceof Error && error.cause instanceof Error ? `; cause=${error.cause.message}` : '';
+    return { ok: false, detail: `${error instanceof Error ? error.message : String(error)}${cause}`.slice(0, 500) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function observeRecentMacNetworkExtensionChanges(
+  runCommand: CommandRunner = command,
+): Promise<{ ok: boolean; detail: string } | undefined> {
+  if (process.platform !== 'darwin') return undefined;
+  const result = await runCommand('/usr/bin/log', [
+    'show', '--last', '90s', '--style', 'compact', '--predicate',
+    'process == "nesessionmanager" AND (eventMessage CONTAINS[c] "configuration changed" OR eventMessage CONTAINS[c] "neconfigurationchanged")',
+  ], 3_000, { maxOutputBytes: 12_000 });
+  const output = (result.stdout || result.stderr).trim();
+  return {
+    ok: result.ok,
+    detail: output ? output.slice(-4_000) : (result.ok ? 'no recent Network Extension configuration changes observed' : 'Network Extension event query failed'),
+  };
+}
+
+async function persistOpenAiTransportIncidentEvidence(input: {
+  config: RecoveryConfig;
+  verify: VerifyResult;
+  runtimeObservation: ReturnType<typeof observeRuntimeStatus>;
+  recoveryTunnel: OpenAiSecureTunnelRuntimeObservation;
+}): Promise<void> {
+  const primaryTunnel = configuredPrimaryPublicTunnel(input.config);
+  const [openAiApi, connectorActivity, macNetworkExtension, primaryTunnelObservation] = await Promise.all([
+    probeOpenAiApiReachability(),
+    probeReleaseCutoverReadiness(input.config, { timeoutMs: 1_000 }),
+    observeRecentMacNetworkExtensionChanges(),
+    primaryTunnel?.platform === 'openai-secure-tunnel'
+      ? observeOpenAiTunnelRuntime(primaryTunnel)
+      : Promise.resolve(undefined),
+  ]);
+  const activeReleaseSessions = listCompleteReleaseSessions(input.config.controllerHome).sessions
+    .filter((session) => !['known_good', 'rolled_back', 'failed'].includes(session.phase))
+    .sort((left, right) => Date.parse(right.updatedAt) - Date.parse(left.updatedAt))
+    .slice(0, 3)
+    .map((session) => ({ sessionId: session.sessionId, phase: session.phase, revision: session.revision, updatedAt: session.updatedAt }));
+  const incidentDetail = [
+    `alias=${input.recoveryTunnel.alias}`,
+    `tunnel=${input.recoveryTunnel.tunnelId}`,
+    `client=${input.recoveryTunnel.clientInstanceId ?? 'unknown'}`,
+    `controlPlane=${input.recoveryTunnel.controlPlaneState}`,
+    input.recoveryTunnel.controlPlaneDetail,
+  ].join('; ');
+  const diagnostic = persistWatchdogDiagnosticEvidence(input.config, {
+    ...input.verify,
+    ok: false,
+    probes: {
+      recovery_tunnel_runtime: { ok: false, detail: incidentDetail },
+    },
+  });
+  audit(input.config, 'network_transport_incident_observed', {
+    diagnosticFingerprint: diagnostic?.fingerprint,
+    recoveryTunnel: {
+      alias: input.recoveryTunnel.alias,
+      tunnelId: input.recoveryTunnel.tunnelId,
+      clientInstanceId: input.recoveryTunnel.clientInstanceId,
+      controlPlaneState: input.recoveryTunnel.controlPlaneState,
+      controlPlaneDetail: input.recoveryTunnel.controlPlaneDetail,
+      localHealthy: input.recoveryTunnel.healthy,
+      localReady: input.recoveryTunnel.ready,
+    },
+    primaryTunnel: primaryTunnelObservation ? {
+      alias: primaryTunnelObservation.alias,
+      tunnelId: primaryTunnelObservation.tunnelId,
+      clientInstanceId: primaryTunnelObservation.clientInstanceId,
+      controlPlaneState: primaryTunnelObservation.controlPlaneState,
+      controlPlaneDetail: primaryTunnelObservation.controlPlaneDetail,
+      localHealthy: primaryTunnelObservation.healthy,
+      localReady: primaryTunnelObservation.ready,
+    } : undefined,
+    openAiApi,
+    connectorActivity,
+    runtime: {
+      releaseId: input.runtimeObservation.snapshot?.releaseId,
+      runtimeInstanceId: input.runtimeObservation.snapshot?.runtimeInstanceId,
+      pid: input.runtimeObservation.snapshot?.pid,
+      ready: input.runtimeObservation.ready,
+      stale: input.runtimeObservation.stale,
+    },
+    releaseSessions: activeReleaseSessions,
+    macNetworkExtension,
+  });
+}
+
 async function probeMcp(config: RecoveryConfig, transport: RecoveryHttpTransport): Promise<Record<string, { ok: boolean; detail: string; value?: unknown }>> {
   const url = config.publicMcpUrl ?? runtimeEndpoint(config);
   if (!url) return { mcp_initialize: { ok: false, detail: 'canonical Runtime MCP endpoint is unavailable' } };
@@ -1230,6 +1734,24 @@ export async function verifyStableRuntime(
         : 'canonical Runtime is not running',
     },
   };
+  const knownGoodRecoverability = inspectKnownGoodRecoverability(config);
+  probes.recovery_known_good_recoverability = {
+    ok: knownGoodRecoverability.unavailable.length === 0,
+    detail: knownGoodRecoverability.unavailable.length === 0
+      ? `${knownGoodRecoverability.available.length} bounded known-good Runtime release(s) are physically recoverable`
+      : `${knownGoodRecoverability.unavailable.length} known-good attestation(s) no longer have a matching immutable Runtime release`,
+    value: knownGoodRecoverability,
+  };
+  if (!observation.running || !observation.ready) {
+    const startupFailure = readRuntimeStartupFailureEvidence(config.controllerHome);
+    if (startupFailure && (!active || !startupFailure.releaseId || startupFailure.releaseId === active.revision)) {
+      probes.runtime_startup_failure = {
+        ok: false,
+        detail: `latest Runtime startup failed during ${startupFailure.stage}: ${startupFailure.reasonCode}${startupFailure.message ? ` — ${startupFailure.message}` : ''}`,
+        value: startupFailure,
+      };
+    }
+  }
   const endpoint = observation.snapshot?.endpoint;
   probes.active_gateway = endpoint
     ? await probe(transport, runtimeHealthEndpoint(endpoint))
@@ -1250,7 +1772,10 @@ export async function verifyStableRuntime(
   const primaryConnectorLocal = await probePrimaryConnectorLocal(config, transport);
   if (primaryConnectorLocal) probes.primary_connector_local = primaryConnectorLocal;
   if (config.gateway) probes.recovery_gateway = await probe(transport, `http://${config.gateway.host}:${config.gateway.port}/health`);
-  const watchdogHealth = observeRecoveryWatchdogHealth(config.controllerHome);
+  const watchdogHealth = observeRecoveryWatchdogHealth(
+    config.controllerHome,
+    config.installProfile === 'self-healing',
+  );
   probes.recovery_watchdog = {
     ok: watchdogHealth.ok,
     detail: watchdogHealth.detail,
@@ -1267,8 +1792,24 @@ export async function verifyStableRuntime(
   const recoveryTunnelRuntime = await probeOpenAiRecoveryTunnel(config);
   if (recoveryTunnelRuntime) probes.recovery_tunnel_runtime = recoveryTunnelRuntime;
   if (options.probeMcpProtocol !== false) Object.assign(probes, await probeMcp(config, transport));
+  const mcpProtocolProbeNames = ['mcp_initialize', 'mcp_initialized_notification', 'mcp_tools_list', 'mcp_read_only_call', 'mcp_session_close'] as const;
+  const mcpProtocolHealthy = options.probeMcpProtocol !== false
+    && mcpProtocolProbeNames.every((name) => probes[name]?.ok === true);
   const coreChecks = Object.entries(probes)
     .filter(([name]) => !name.startsWith('recovery_'))
+    // The unauthenticated public initialize probe remains diagnostic and is the
+    // authority for dedicated external/tunnel verification. Once the stronger
+    // authenticated MCP session completes end-to-end, that raw reachability
+    // probe cannot independently veto full stable Runtime verification.
+    .filter(([name]) => !(name === 'external_mcp_http' && mcpProtocolHealthy))
+    // The OpenAI tunnel control-plane lookup is likewise diagnostic when the
+    // local tunnel identity/readiness is exact and the stronger public MCP data
+    // plane has already completed end-to-end. Real tunnel/data-plane failures
+    // still remain in coreChecks and fail closed.
+    .filter(([name, entry]) => !(
+      name === 'primary_tunnel_runtime'
+      && isPrimaryTunnelControlPlaneOnlyDegradation(entry, mcpProtocolHealthy)
+    ))
     .every(([, entry]) => entry.ok);
   const runtimeHealthy = observation.running && observation.ready && !observation.stale;
   const coherent = Boolean(
@@ -1309,6 +1850,139 @@ export async function verifyStableRuntime(
   });
   return result;
 }
+function recoveryBundleId(): string {
+  return `attestation-${Date.now()}-${randomUUID().replaceAll('-', '').slice(0, 16)}`;
+}
+
+/**
+ * Build a self-contained, Recovery-owned restore point before publishing its
+ * attestation.  The copy is intentionally made while the full Runtime is
+ * still verified and fenced; a later crash cannot turn a metadata-only record
+ * into a false known-good authority.
+ */
+function createKnownGoodRecoveryBundle(config: RecoveryConfig): KnownGoodRecoveryBundle {
+  const attestationId = recoveryBundleId();
+  const root = join(knownGoodRecoveryBundleRoot(config.controllerHome), attestationId);
+  const databasePath = join(root, 'controller.sqlite');
+  const serviceContractPath = join(root, 'service-contract.json');
+  try {
+    const database = backupControlPlaneDatabase(config.controllerHome, databasePath);
+    const servicePaths = forgeRuntimeServicePaths(config.controllerHome);
+    const serviceConfig = readForgeRuntimeServiceConfig(servicePaths.configPath);
+    const serviceContract = {
+      schemaVersion: 1 as const,
+      configPath: servicePaths.configPath,
+      serviceConfig,
+      // The label and fixed executable path are derived, never copied from a
+      // mutable launchd plist. Recovery can rebuild that contract from this
+      // declarative service configuration plus the immutable release.
+      label: servicePaths.label,
+      activeEntrypointPath: servicePaths.activeEntrypointPath,
+      createdAt: new Date().toISOString(),
+    };
+    writeJson(serviceContractPath, serviceContract);
+    return {
+      schemaVersion: 1,
+      attestationId,
+      root,
+      database: {
+        path: databasePath,
+        sha256: sha256FileBounded(databasePath),
+        schemaVersion: database.schemaVersion,
+        recordCount: database.recordCount,
+        auditEventCount: database.auditEventCount,
+      },
+      serviceContract: { path: serviceContractPath, sha256: sha256FileBounded(serviceContractPath) },
+      createdAt: new Date().toISOString(),
+    };
+  } catch (error) {
+    rmSync(root, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function pruneRetiredKnownGoodRecoveryBundles(config: RecoveryConfig, releases: readonly ReleaseEvidence[]): void {
+  const root = knownGoodRecoveryBundleRoot(config.controllerHome);
+  if (!existsSync(root)) return;
+  const retained = new Set(releases.flatMap((release) => release.recoveryBundle ? [resolve(release.recoveryBundle.root)] : []));
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const path = resolve(root, entry.name);
+    if (dirname(path) !== resolve(root) || retained.has(path)) continue;
+    rmSync(path, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Reconcile Recovery's restore-point ledger with the only releases that the
+ * committed Runtime authority can actually roll back to. Historical
+ * attestations are evidence, not a second rollback authority, and must not
+ * keep full SQLite bundles and immutable Runtime trees alive indefinitely.
+ */
+function reconcileKnownGoodRecoveryRetention(config: RecoveryConfig): void {
+  const store = knownGood(config);
+  if (store.schemaVersion !== 2 || store.releases.length === 0) return;
+  const authority = releaseAuthority(config);
+  if (!authority) throw new Error('KNOWN_GOOD_RETENTION_RUNTIME_AUTHORITY_MISSING');
+  const rollbackReleases = [
+    releaseEvidence(config.controllerHome, authority.active, authority),
+    ...(authority.previous ? [releaseEvidence(config.controllerHome, authority.previous, authority)] : []),
+  ].filter((release): release is ReleaseEvidence => Boolean(release));
+  const retained: ReleaseEvidence[] = [];
+  for (const entry of store.releases) {
+    const rollbackEntry = rollbackReleases.find((release) => sameReleaseIdentity(release, entry));
+    if (!rollbackEntry) continue;
+    try { inspectKnownGoodRecoveryBundle(config.controllerHome, entry); }
+    catch (error) {
+      throw new Error(`KNOWN_GOOD_RETENTION_AUTHORITY_INVALID: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    retained.push(entry);
+  }
+  if (retained.length === store.releases.length) return;
+  writeJson(statePath(config), { schemaVersion: 2, releases: retained, updatedAt: new Date().toISOString() } satisfies KnownGoodStore);
+  pruneRetiredKnownGoodRecoveryBundles(config, retained);
+}
+
+interface ReleaseSessionStorageEstimate {
+  requiredBytes: number;
+  reserveBytes: number;
+}
+
+function estimateReleaseSessionCandidateBytes(config: RecoveryConfig, manifestPath: string): ReleaseSessionStorageEstimate {
+  const releaseRoot = dirname(resolve(manifestPath));
+  const releaseMeasurement = measureReclaimablePath(releaseRoot, 100_000);
+  const sourceRoot = config.primaryRuntimeSourceRoot?.trim();
+  if (!sourceRoot) throw new Error('RELEASE_SESSION_STORAGE_SOURCE_UNAVAILABLE');
+  const resolvedSourceRoot = resolve(sourceRoot);
+  const sourceMeasurement = measureReclaimablePath(resolvedSourceRoot, 100_000);
+  const dependencyRoot = join(resolvedSourceRoot, 'node_modules');
+  const dependencyMeasurement = existsSync(dependencyRoot)
+    ? measureReclaimablePath(realpathSync(dependencyRoot), 1_000_000)
+    : { bytes: 0, entries: 0, complete: true };
+  const databasePath = join(resolve(config.controllerHome), 'control-plane.sqlite');
+  let databaseBytes: number;
+  try { databaseBytes = Math.max(0, statSync(databasePath).size); }
+  catch (error) { throw new Error(`RELEASE_SESSION_STORAGE_DATABASE_UNAVAILABLE: ${error instanceof Error ? error.message : String(error)}`); }
+  if (!releaseMeasurement.complete) throw new Error('RELEASE_SESSION_STORAGE_RELEASE_ESTIMATE_INCOMPLETE');
+  if (!sourceMeasurement.complete) throw new Error('RELEASE_SESSION_STORAGE_SOURCE_ESTIMATE_INCOMPLETE');
+  if (!dependencyMeasurement.complete) throw new Error('RELEASE_SESSION_STORAGE_DEPENDENCY_ESTIMATE_INCOMPLETE');
+  // The candidate is rebuilt from the frozen checkout, not copied from the
+  // active release. It creates a detached worktree, a dependency-inclusive
+  // package snapshot, compiled artifacts, and a consistent SQLite snapshot.
+  // Account for each independently rather than treating the active tree as a
+  // proxy for the build's incremental footprint.
+  const sourceBytes = releaseMeasurement.bytes
+    + sourceMeasurement.bytes
+    + dependencyMeasurement.bytes
+    + databaseBytes;
+  if (!Number.isFinite(sourceBytes) || sourceBytes < 1) throw new Error('RELEASE_SESSION_STORAGE_ESTIMATE_INVALID');
+  // Keep an equally sized reserve for compiler/materialization variance and
+  // atomic promotion, rather than treating the global warning threshold as
+  // rollback capacity.
+  const measuredBytes = Math.max(1, Math.ceil(sourceBytes));
+  return { requiredBytes: measuredBytes, reserveBytes: measuredBytes };
+}
+
 /** Explicitly records evidence only after the full independent verification passed. */
 function persistVerifiedKnownGood(config: RecoveryConfig, verified: VerifyResult, performance: RuntimePerformanceEvidence): ReleaseEvidence {
   const authority = releaseAuthority(config);
@@ -1332,13 +2006,19 @@ function persistVerifiedKnownGood(config: RecoveryConfig, verified: VerifyResult
       releaseAuthorityRevision: authority.revision,
       releaseFencingTokenSha256: createHash('sha256').update(authority.fencingToken).digest('hex'),
       attestedAt: new Date().toISOString(),
+      recoveryBundle: createKnownGoodRecoveryBundle(config),
     };
     const store = knownGood(config);
+    const previous = authority.previous ? releaseEvidence(config.controllerHome, authority.previous, authority) : undefined;
     const releases = [
       attested,
-      ...store.releases.filter((entry) => entry.path !== active.path && existsSync(entry.path)),
-    ].slice(0, 8);
-    writeJson(statePath(config), { schemaVersion: 1, releases, updatedAt: new Date().toISOString() } satisfies KnownGoodStore);
+      ...(previous ? store.releases.filter((entry) => sameReleaseIdentity(entry, previous)) : []),
+    ];
+    writeJson(statePath(config), { schemaVersion: 2, releases, updatedAt: new Date().toISOString() } satisfies KnownGoodStore);
+    // State is durable before cleanup. A crash between these lines leaves an
+    // orphaned bundle, which this same owner removes on the next attestation;
+    // it never invalidates a published recovery point.
+    pruneRetiredKnownGoodRecoveryBundles(config, releases);
     audit(config, 'known_good_attested', {
       revision: active.revision,
       artifactIdentity: active.artifactIdentity,
@@ -1363,6 +2043,82 @@ function runtimePerformanceIdentity(config: RecoveryConfig): RuntimePerformanceI
   };
 }
 
+export const RECOVERY_INTERNAL_PERFORMANCE_COMMAND = '__measure-runtime-performance';
+
+export async function measureConfiguredRuntimePerformance(
+  config: RecoveryConfig,
+  dependencies: RuntimePerformanceDependencies = {},
+): Promise<RuntimePerformanceEvidence> {
+  return await measureRuntimePerformance(() => runtimePerformanceIdentity(config), dependencies);
+}
+
+function hasRuntimePerformanceTestSeam(dependencies: RuntimePerformanceDependencies): boolean {
+  return dependencies.readCpu !== undefined
+    || dependencies.monotonicNow !== undefined
+    || dependencies.wallNow !== undefined
+    || dependencies.sleep !== undefined;
+}
+
+async function measureRuntimePerformanceIsolated(
+  config: RecoveryConfig,
+  expectedIdentity: RuntimePerformanceIdentity,
+): Promise<RuntimePerformanceEvidence> {
+  const recoveryBefore = readCurrentRecoveryRelease(config.controllerHome);
+  if (!recoveryBefore) throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: current immutable Recovery release unavailable');
+  const executable = join(recoveryBefore.releasePath, 'forge-recovery');
+  if (!existsSync(executable)) throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: immutable Recovery sampler executable unavailable');
+
+  const result = await runBoundedChild(
+    executable,
+    [RECOVERY_INTERNAL_PERFORMANCE_COMMAND, '--controller-home', config.controllerHome],
+    {
+      timeoutMs: 100_000,
+      maxOutputBytes: 32 * 1024,
+      forwardSignals: false,
+      env: runtimeAuthorityFreeEnvironment(process.env),
+    },
+  );
+  if (result.status !== 0 || result.failureCode || result.timedOut) {
+    const detail = result.failureCode ?? result.error ?? (result.stderr.trim() || `exit=${result.status}`);
+    throw new Error(`RECOVERY_PERFORMANCE_UNKNOWN: isolated sampler failed (${detail.slice(0, 240)})`);
+  }
+
+  let envelope: unknown;
+  try {
+    envelope = JSON.parse(result.stdout);
+  } catch {
+    throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: isolated sampler returned malformed evidence');
+  }
+  if (!envelope || typeof envelope !== 'object' || Array.isArray(envelope)) {
+    throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: isolated sampler returned invalid evidence envelope');
+  }
+  const parsed = envelope as { schemaVersion?: unknown; ok?: unknown; evidence?: unknown; error?: unknown };
+  if (parsed.schemaVersion !== 1 || typeof parsed.ok !== 'boolean') {
+    throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: isolated sampler returned invalid evidence envelope');
+  }
+  if (!parsed.ok) {
+    const detail = typeof parsed.error === 'string' ? parsed.error : '';
+    if (/^RECOVERY_PERFORMANCE_(?:UNKNOWN|REJECTED):/.test(detail)) throw new Error(detail);
+    throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: isolated sampler returned an unclassified failure');
+  }
+  if (!parsed.evidence || typeof parsed.evidence !== 'object' || Array.isArray(parsed.evidence)) {
+    throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: isolated sampler omitted performance evidence');
+  }
+  const performance = parsed.evidence as RuntimePerformanceEvidence;
+  assertRuntimePerformanceEvidence(performance, expectedIdentity);
+
+  const recoveryAfter = readCurrentRecoveryRelease(config.controllerHome);
+  if (!recoveryAfter
+    || recoveryAfter.releaseRevision !== recoveryBefore.releaseRevision
+    || recoveryAfter.manifestSha256 !== recoveryBefore.manifestSha256) {
+    throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: Recovery release changed during performance observation');
+  }
+  if (!samePerformanceIdentity(expectedIdentity, runtimePerformanceIdentity(config))) {
+    throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: Runtime or release authority changed after performance observation');
+  }
+  return performance;
+}
+
 export async function attestKnownGood(
   config: RecoveryConfig,
   dependencies: RuntimePerformanceDependencies = {},
@@ -1376,17 +2132,20 @@ export async function attestKnownGood(
     throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: Runtime or release authority changed during functional verification');
   }
 
-  // Performance observation is read-only and deliberately stays outside the
-  // single Recovery mutation lock. Runtime/release identity is fenced on every
-  // sample; a concurrent restart/rollback/activation therefore invalidates the
-  // evidence instead of being blocked for the six-minute observation window.
-  const performance = await measureRuntimePerformance(() => {
-    const current = runtimePerformanceIdentity(config);
-    if (!samePerformanceIdentity(verifiedIdentity, current)) {
-      throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: Runtime or release authority changed after functional verification');
-    }
-    return current;
-  }, dependencies);
+  // Production observation executes in one short-lived child of the exact
+  // immutable Recovery release so Gateway/watchdog work in the persistent
+  // daemon cannot stretch the sampler's monotonic windows. Explicit dependency
+  // hooks remain the in-process test seam only. Both paths stay read-only and
+  // outside the Recovery mutation lock; exact Runtime identity remains fenced.
+  const performance = hasRuntimePerformanceTestSeam(dependencies)
+    ? await measureRuntimePerformance(() => {
+        const current = runtimePerformanceIdentity(config);
+        if (!samePerformanceIdentity(verifiedIdentity, current)) {
+          throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: Runtime or release authority changed after functional verification');
+        }
+        return current;
+      }, dependencies)
+    : await measureRuntimePerformanceIsolated(config, verifiedIdentity);
 
   const locked = await withLock(config, { action: 'attest_known_good' }, async () => {
     const verified = await verifyStableRuntime(config);
@@ -1442,7 +2201,8 @@ async function rollbackPreviousLocked(config: RecoveryConfig, reason: string): P
   }
   const operationId = `recovery-rollback-${Date.now()}-${randomUUID().slice(0, 8)}`;
   try {
-    const committed = rollbackRuntimeRelease(config.controllerHome, operationId);
+    const rollbackResult = rollbackRuntimeReleaseWithResult(config.controllerHome, operationId);
+    const committed = rollbackResult.authority;
     if (
       committed.active.releaseId !== target.revision
       || committed.active.artifactIdentity !== target.artifactIdentity
@@ -1455,11 +2215,16 @@ async function rollbackPreviousLocked(config: RecoveryConfig, reason: string): P
       activeRevision: active.revision,
       restoredRevision: target.revision,
       restoredManifestSha256: target.manifestSha256,
+      databaseDisposition: rollbackResult.databaseDisposition,
+      liveAuditEventCount: rollbackResult.liveAuditEventCount,
+      rollbackAuditEventCount: rollbackResult.rollbackAuditEventCount,
     });
     return {
       ok: true,
       operationId,
-      detail: 'whole-Runtime release and SQLite backup restored; Canonical Runtime remains stopped until its sole launcher starts it',
+      detail: rollbackResult.databaseDisposition === 'restored_backup'
+        ? 'whole-Runtime release and unchanged SQLite backup restored; Canonical Runtime remains stopped until its sole launcher starts it'
+        : 'whole-Runtime release restored while newer live SQLite state was preserved; Canonical Runtime remains stopped until its sole launcher starts it',
     };
   } catch (error) {
     const detail = error instanceof Error ? error.message : 'whole-Runtime rollback failed';
@@ -1508,65 +2273,226 @@ async function verifyLocalRuntime(
   }, createRecoveryHttpTransport(config.controllerHome), options);
 }
 
-function isExternalTunnelFailure(config: RecoveryConfig, verified: VerifyResult, localVerify: VerifyResult): boolean {
-  const configured = configuredRecoveryTunnel(config);
-  const localRecoveryGatewayHealthy = localVerify.probes.recovery_gateway?.ok ?? true;
-  if (!configured || !localVerify.ok || !localRecoveryGatewayHealthy) return false;
-  if (configured.platform === 'openai-secure-tunnel') return verified.probes.recovery_tunnel_runtime?.ok !== true;
-  const external = verified.probes.recovery_external_http ?? verified.probes.external_mcp_http;
-  return Boolean(configuredRecoveryPublicUrl(config) && external?.ok !== true);
-}
-
-export const WATCHDOG_RUNTIME_STARTUP_GRACE_MS = 60_000;
-export const WATCHDOG_RUNTIME_RESTART_BUDGET_STABLE_MS = 5 * 60_000;
-
-export function watchdogRuntimeStartupGraceMs(
-  config: Pick<RecoveryConfig, 'primaryRuntimeService'>,
-): number {
-  const configuredVerifyTimeout = config.primaryRuntimeService?.postRestartVerifyTimeoutMs;
-  return Math.max(
-    WATCHDOG_RUNTIME_STARTUP_GRACE_MS,
-    Number.isFinite(configuredVerifyTimeout) ? Math.max(0, configuredVerifyTimeout ?? 0) : 0,
-  );
-}
-
-export function runtimeWithinWatchdogStartupGrace(
-  input: { running: boolean; stale: boolean; snapshot?: { startedAt?: string } },
-  nowMs = Date.now(),
-  graceMs = WATCHDOG_RUNTIME_STARTUP_GRACE_MS,
-): boolean {
-  const startedAtMs = input.snapshot?.startedAt ? Date.parse(input.snapshot.startedAt) : Number.NaN;
-  return Boolean(
-    input.running
-    && !input.stale
-    && Number.isFinite(startedAtMs)
-    && nowMs >= startedAtMs
-    && nowMs - startedAtMs < Math.max(0, graceMs),
-  );
-}
-
-export function runtimeRestartBudgetIdentity(release: Pick<ReleaseEvidence, 'revision' | 'artifactIdentity' | 'manifestSha256'> | undefined): string | undefined {
-  if (!release?.revision || !release.artifactIdentity || !release.manifestSha256) return undefined;
-  return `${release.revision}:${release.artifactIdentity}:${release.manifestSha256}`;
+/**
+ * Release cutover must not create fresh sessions on the Connector whose quiet
+ * window fences the activation.  The Runtime/Recovery surfaces are sufficient
+ * to verify the frozen Stable A and Candidate B identities; probing the
+ * primary Connector here would refresh its activity timestamp and make the
+ * cutover gate self-starve on every automatic retry.
+ */
+async function verifyLocalRuntimeForReleaseCutover(config: RecoveryConfig): Promise<VerifyResult> {
+  return verifyLocalRuntime({ ...config, primaryConnectorService: undefined }, { probeMcpProtocol: false });
 }
 
 /**
- * Bind primary Runtime restart accounting to the exact immutable Runtime release.
- * A missing identity is a legacy-state migration: retain its counters and bind
- * them to the currently observed release so a watchdog upgrade cannot mint a
- * fresh restart budget for an already failing Runtime.
+ * Bounded observation owns health, not release verification. Keep this path
+ * deliberately bounded to already-published Runtime authority/status plus local
+ * HTTP transport checks needed for prompt targeted repair. Expensive execution
+ * canaries, known-good bundle inspection, external transport probes and MCP
+ * initialize/list/call stay in verifyStableRuntime/verifyLocalRuntime and run
+ * only on the periodic verification deadline or an explicit strict boundary.
  */
-export function scopeWatchdogStateToRuntimeRelease(
-  state: WatchdogState,
-  release: Pick<ReleaseEvidence, 'revision' | 'artifactIdentity' | 'manifestSha256'> | undefined,
-): WatchdogState {
-  const identity = runtimeRestartBudgetIdentity(release);
-  if (!identity || state.runtimeRestartBudgetIdentity === identity) return state;
-  if (!state.runtimeRestartBudgetIdentity) return { ...state, runtimeRestartBudgetIdentity: identity };
-  return {
-    ...state,
-    failures: 0,
-    firstFailureAt: undefined,
+async function observeBoundedRuntimeHealth(
+  config: RecoveryConfig,
+  transport: RecoveryHttpTransport,
+  options: {
+    /**
+     * Primary Connector probing is excluded from repair surfaces that must keep
+     * working while the primary transport is the broken thing.
+     */
+    includePrimaryConnectorLocal?: boolean;
+    /**
+     * Public/Connector transport probes are lightweight health evidence but
+     * create Connector activity. Disable them while a ReleaseSession is waiting
+     * for the cutover quiet window so watchdog observation cannot self-starve it.
+     */
+    includePrimaryTransport?: boolean;
+  } = {},
+): Promise<VerifyResult> {
+  const observation = observeRuntimeStatus(config.controllerHome);
+  const authority = releaseAuthority(config);
+  const active = activeAuthorityRelease(config);
+  const previous = previousAuthorityRelease(config);
+  const runtimeHealthy = observation.running && observation.ready && !observation.stale;
+  const coherent = Boolean(
+    authority
+    && active
+    && observation.snapshot?.releaseId === active.revision
+    && observation.snapshot?.artifactIdentity === active.artifactIdentity
+    && authority.active.workerProtocolVersion === active.workerProtocolVersion
+  );
+  const probes: VerifyResult['probes'] = {
+    runtime_status: {
+      ok: observation.running && !observation.stale,
+      detail: observation.running
+        ? observation.stale ? 'canonical Runtime status is stale' : 'canonical Runtime owner is live'
+        : 'canonical Runtime is not running',
+    },
+  };
+  const endpoint = observation.snapshot?.endpoint;
+  probes.active_gateway = endpoint
+    ? await probe(transport, runtimeHealthEndpoint(endpoint))
+    : { ok: false, detail: 'canonical Runtime endpoint is unavailable' };
+  if (options.includePrimaryTransport !== false && config.publicMcpUrl) {
+    probes.external_mcp_http = await probeExternalMcp(transport, config.publicMcpUrl);
+    const connectorReadinessEndpoint = config.primaryConnectorService?.localMcpUrl?.trim() || config.publicMcpUrl;
+    probes.primary_connector_ready = await probePublicGatewayReadiness(transport, connectorReadinessEndpoint, {
+      acceptOAuthChallenge: packageConnectorAuthMode(config.controllerHome) === 'oauth',
+    });
+  }
+  if (options.includePrimaryTransport !== false) {
+    const primaryTunnel = configuredPrimaryPublicTunnel(config);
+    if (primaryTunnel?.platform === 'openai-secure-tunnel') {
+      const observed = await observeOpenAiTunnelRuntime(primaryTunnel);
+      probes.primary_tunnel_runtime = { ok: observed.ok, detail: observed.detail, value: observed };
+    }
+  }
+  if (options.includePrimaryConnectorLocal !== false) {
+    const primaryConnectorLocal = await probePrimaryConnectorLocal(config, transport);
+    if (primaryConnectorLocal) probes.primary_connector_local = primaryConnectorLocal;
+  }
+  if (config.gateway) probes.recovery_gateway = await probe(transport, `http://${config.gateway.host}:${config.gateway.port}/health`);
+  const watchdogHealth = observeRecoveryWatchdogHealth(
+    config.controllerHome,
+    config.installProfile === 'self-healing',
+  );
+  probes.recovery_watchdog = {
+    ok: watchdogHealth.ok,
+    detail: watchdogHealth.detail,
+    value: {
+      pulseAgeMs: watchdogHealth.pulseAgeMs,
+      tickAgeMs: watchdogHealth.tickAgeMs,
+      currentReleaseRevision: watchdogHealth.currentReleaseRevision,
+      watchdogReleaseRevision: watchdogHealth.runtimeIdentity?.releaseRevision,
+      watchdogPid: watchdogHealth.runtimeIdentity?.pid,
+    },
+  };
+  // The dedicated Recovery transport is the only channel that can repair a
+  // broken primary transport. It must be observed on every liveness tick, or a
+  // dead Recovery tunnel stays invisible while the watchdog keeps reporting a
+  // healthy system and never reaches the bounded tunnel-repair path.
+  const recoveryTransport = await probeOpenAiRecoveryTunnel(config);
+  if (recoveryTransport) probes.recovery_tunnel_runtime = recoveryTransport;
+  const localChecks = Object.entries(probes)
+    .filter(([name]) => !name.startsWith('recovery_'))
+    .every(([, entry]) => entry.ok);
+  return {
+    ok: Boolean(runtimeHealthy && coherent && localChecks),
+    at: new Date().toISOString(),
+    runtime: {
+      ok: runtimeHealthy,
+      running: observation.running,
+      ready: observation.ready,
+      stale: observation.stale,
+      reasonCodes: [...observation.reasonCodes],
+    },
+    releases: {
+      active,
+      previous,
+      // This tier reports durable attestation identity only. Physical bundle
+      // integrity is deliberately reserved for strict verification boundaries.
+      knownGood: matchingKnownGoodAttestation(config, active),
+      coherent,
+    },
+    probes,
+  };
+}
+
+async function observeWatchdogHealthTier(
+  config: RecoveryConfig,
+  transport = createRecoveryHttpTransport(config.controllerHome),
+): Promise<VerifyResult> {
+  // The primary Connector quiet window is a cutover fence. Once the same
+  // ReleaseSession is eligible for cutover, Recovery's five-second health
+  // probe must stop opening Connector MCP sessions or it will continuously
+  // refresh the very activity timestamp that the fence is waiting to drain.
+  // An incomplete inventory fails closed by retaining the normal probe.
+  const inventory = listCompleteReleaseSessions(config.controllerHome);
+  const cutoverQuietWindowRequired = inventory.invalidSessionFiles.length === 0
+    && inventory.sessions.some((session) => (
+      session.phase === 'cutover_eligible'
+      || session.phase === 'cutover_attempting'
+      || session.phase === 'cutover_committed'
+    ));
+  const primaryTransportAttributionRequired = Boolean(
+    config.primaryConnectorService || configuredPrimaryPublicTunnel(config),
+  );
+  return observeBoundedRuntimeHealth(config, transport, {
+    includePrimaryConnectorLocal: !cutoverQuietWindowRequired,
+    // A plain public URL is strict-verification evidence, not a five-second
+    // liveness dependency. Probe primary transport on the cheap tier only when
+    // Recovery has a managed Connector/tunnel whose failure attribution can
+    // drive a bounded repair decision.
+    includePrimaryTransport: !cutoverQuietWindowRequired && primaryTransportAttributionRequired,
+  });
+}
+
+function isExternalTunnelFailure(config: RecoveryConfig, verified: VerifyResult, localVerify: VerifyResult): boolean {
+  const configured = configuredRecoveryTunnel(config);
+  const localRecoveryGatewayHealthy = localVerify.probes.recovery_gateway?.ok ?? true;
+  if (!configured || !localVerify.ok || !localRecoveryGatewayHealthy) return false;
+  if (configured.platform === 'openai-secure-tunnel') {
+    const observed = openAiTunnelObservationFromProbe(verified.probes.recovery_tunnel_runtime);
+    // A locally healthy tunnel with degraded/unknown OpenAI control-plane reachability
+    // is an upstream transport incident, not evidence that reconnecting the local
+    // tunnel process is a valid repair. Keep it degraded and collect evidence.
+    if (isUpstreamOpenAiControlPlaneIncident(observed)) return false;
+    return verified.probes.recovery_tunnel_runtime?.ok !== true;
+  }
+  const external = verified.probes.recovery_external_http ?? verified.probes.external_mcp_http;
+  return Boolean(configuredRecoveryPublicUrl(config) && external?.ok !== true);
+}
+
+export const WATCHDOG_RUNTIME_STARTUP_GRACE_MS = 60_000;
+export const WATCHDOG_RUNTIME_RESTART_BUDGET_STABLE_MS = 5 * 60_000;
+
+export function watchdogRuntimeStartupGraceMs(
+  config: Pick<RecoveryConfig, 'primaryRuntimeService'>,
+): number {
+  const configuredVerifyTimeout = config.primaryRuntimeService?.postRestartVerifyTimeoutMs;
+  return Math.max(
+    WATCHDOG_RUNTIME_STARTUP_GRACE_MS,
+    Number.isFinite(configuredVerifyTimeout) ? Math.max(0, configuredVerifyTimeout ?? 0) : 0,
+  );
+}
+
+export function runtimeWithinWatchdogStartupGrace(
+  input: { running: boolean; stale: boolean; snapshot?: { startedAt?: string } },
+  nowMs = Date.now(),
+  graceMs = WATCHDOG_RUNTIME_STARTUP_GRACE_MS,
+): boolean {
+  const startedAtMs = input.snapshot?.startedAt ? Date.parse(input.snapshot.startedAt) : Number.NaN;
+  return Boolean(
+    input.running
+    && !input.stale
+    && Number.isFinite(startedAtMs)
+    && nowMs >= startedAtMs
+    && nowMs - startedAtMs < Math.max(0, graceMs),
+  );
+}
+
+export function runtimeRestartBudgetIdentity(release: Pick<ReleaseEvidence, 'revision' | 'artifactIdentity' | 'manifestSha256'> | undefined): string | undefined {
+  if (!release?.revision || !release.artifactIdentity || !release.manifestSha256) return undefined;
+  return `${release.revision}:${release.artifactIdentity}:${release.manifestSha256}`;
+}
+
+/**
+ * Bind primary Runtime restart accounting to the exact immutable Runtime release.
+ * A missing identity is a legacy-state migration: retain its counters and bind
+ * them to the currently observed release so a watchdog upgrade cannot mint a
+ * fresh restart budget for an already failing Runtime.
+ */
+export function scopeWatchdogStateToRuntimeRelease(
+  state: WatchdogState,
+  release: Pick<ReleaseEvidence, 'revision' | 'artifactIdentity' | 'manifestSha256'> | undefined,
+): WatchdogState {
+  const identity = runtimeRestartBudgetIdentity(release);
+  if (!identity || state.runtimeRestartBudgetIdentity === identity) return state;
+  if (!state.runtimeRestartBudgetIdentity) return { ...state, runtimeRestartBudgetIdentity: identity };
+  return {
+    ...state,
+    failures: 0,
+    firstFailureAt: undefined,
     rollbackUsed: false,
     runtimeRestartAttempts: 0,
     runtimeRestartFailures: 0,
@@ -1723,22 +2649,26 @@ export function decideWatchdog(input: {
 
 export async function diagnose(config: RecoveryConfig): Promise<Record<string, unknown>> {
   const verified = await verifyStableRuntime(config);
-  return { verified, knownGood: knownGood(config), quarantine: json(quarantinePath(config)) ?? { releases: [] } };
+  return { verified, knownGood: inspectKnownGoodRecoverability(config), quarantine: json(quarantinePath(config)) ?? { releases: [] } };
 }
 
 export async function listReleases(config: RecoveryConfig): Promise<Record<string, unknown>> {
   const observation = observeRuntimeStatus(config.controllerHome);
+  const knownGoodRecoverability = inspectKnownGoodRecoverability(config);
   return {
     runtimeRunning: observation.running,
     runtimeReady: observation.ready,
     active: activeAuthorityRelease(config),
     previous: previousAuthorityRelease(config),
-    knownGood: knownGood(config).releases,
+    knownGood: knownGoodRecoverability.available,
+    knownGoodUnavailable: knownGoodRecoverability.unavailable,
+    pinned: runtimePin(config)?.release,
   };
 }
 
 interface CommandResult { ok: boolean; status: number | null; stdout: string; stderr: string; }
-type CommandRunner = (commandName: string, args: string[], timeoutMs?: number) => Promise<CommandResult>;
+interface CommandOptions { cwd?: string; home?: string; maxOutputBytes?: number; }
+type CommandRunner = (commandName: string, args: string[], timeoutMs?: number, options?: CommandOptions) => Promise<CommandResult>;
 interface LaunchdService { uid: number; domain: string; target: string; label: string; plistPath: string; }
 
 /**
@@ -1758,6 +2688,28 @@ export function recoveryCommandPath(
   return entries.includes(userBin) ? inheritedPath : [userBin, ...entries].join(delimiter);
 }
 
+/**
+ * Child environment for Recovery-owned commands.
+ *
+ * Keep the hosting Runtime's private FORGE_* authority out, but preserve the
+ * account context: user-installed tools resolve their own per-account state from
+ * HOME, and a persistent launchd/systemd service starts without an interactive
+ * HOME to inherit. Without it, `tunnel-client` cannot see its own alias registry,
+ * so Recovery both misreads a healthy dedicated tunnel as stopped and cannot
+ * confirm the tunnel it just reconnected.
+ */
+export function recoveryCommandEnvironment(
+  env: NodeJS.ProcessEnv = process.env,
+  accountHome = homedir(),
+): NodeJS.ProcessEnv {
+  const home = env.HOME?.trim() || accountHome;
+  return {
+    ...runtimeAuthorityFreeEnvironment(env),
+    PATH: recoveryCommandPath(env.PATH ?? '', process.platform, home),
+    HOME: home,
+  };
+}
+
 export interface PublicTunnelRepairDependencies {
   platform?: NodeJS.Platform;
   currentUid?: () => Promise<number | undefined>;
@@ -1768,14 +2720,14 @@ export interface PublicTunnelRepairDependencies {
   sleep?: (ms: number) => Promise<void>;
 }
 
-function command(commandName: string, args: string[], timeoutMs = 10_000, options: { cwd?: string; maxOutputBytes?: number } = {}): Promise<CommandResult> {
+function command(commandName: string, args: string[], timeoutMs = 10_000, options: CommandOptions = {}): Promise<CommandResult> {
   return new Promise((resolveCommand) => {
     const child = spawn(commandName, args, {
       shell: false,
       stdio: ['ignore', 'pipe', 'pipe'],
       windowsHide: true,
       cwd: options.cwd,
-      env: { ...process.env, PATH: recoveryCommandPath() },
+      env: recoveryCommandEnvironment(process.env, options.home),
     });
     const stdout: Buffer[] = [];
     const stderr: Buffer[] = [];
@@ -1853,10 +2805,14 @@ async function ensureLaunchdServiceStarted(service: LaunchdService, runCommand:
 }
 
 export interface PrimaryRuntimeRecoveryDependencies {
+  /** Explicit operator restart may recycle an already-healthy Runtime; watchdog/internal recovery keeps healthy no-op semantics. */
+  forceHealthyRestart?: boolean;
   platform?: NodeJS.Platform;
   currentUid?: () => Promise<number | undefined>;
   runCommand?: CommandRunner;
   verifyLocal?: (config: RecoveryConfig) => Promise<VerifyResult>;
+  /** Cheap readiness observation used while a restarted Runtime is converging; strict verification remains a separate acceptance boundary. */
+  observeLocal?: (config: RecoveryConfig) => Promise<VerifyResult>;
   /** Rebind the independently supervised OAuth Connector after a whole-Runtime release switch. */
   repairPrimaryConnectorBinding?: (config: RecoveryConfig) => Promise<{ ok: boolean; attempted: boolean; noOp?: boolean; detail: string }>;
   runtimeRunning?: (config: RecoveryConfig) => boolean;
@@ -1865,13 +2821,31 @@ export interface PrimaryRuntimeRecoveryDependencies {
   sleep?: (ms: number) => Promise<void>;
 }
 
+export interface RuntimeReleaseKnownGoodDependencies extends RuntimePerformanceDependencies {
+  /** Test/host seam for the existing whole-Runtime rollback transaction. */
+  rollback?: PrimaryRuntimeRecoveryDependencies;
+  /** Exact active-release live continuation proof; production defaults to the Supervisor single-writer ledger. */
+  continuationProof?: (
+    forgeHome: string,
+    input: { repoId?: string; activeReleaseId: string; notBefore: string },
+  ) => Promise<WorkflowSupervisorContinuationProof | undefined>;
+}
+
 export interface RuntimeReleaseActivationGuard {
   /** External caller identity for audit/lock attribution. */
   requestId?: string;
+  /** Internal Recovery-only mode: allow explicit activation of current.previous when it is durably pinned. */
+  allowPreviousRelease?: boolean;
+  /** Internal Recovery-only mode: restore Runtime authority without restoring an older SQLite backup on activation failure. */
+  preserveDatabaseOnFailure?: boolean;
+  /** Internal Recovery-only pin fence checked after acquiring the mutation lock. */
+  requiredPinnedReleaseRevision?: string;
   /** Authority snapshot observed when the caller decided to activate; null means the caller observed no authority. */
   expectedAuthorityRevision?: number | null;
   /** Active release observed when the caller decided to activate; null means the caller observed no active release. */
   expectedActiveReleaseId?: string | null;
+  /** Fresh portable source candidates may activate only after this exact Recovery ReleaseSession becomes cutover-eligible. */
+  releaseSessionId?: string;
 }
 
 function configuredPrimaryRuntimeService(config: RecoveryConfig, platform: NodeJS.Platform = process.platform): PrimaryRuntimeServiceConfig {
@@ -2067,6 +3041,103 @@ async function probePrimaryConnectorLocal(
   });
 }
 
+export interface AutomaticReleaseCutoverReadiness {
+  ready: boolean;
+  activeSessions?: number;
+  activePosts?: number;
+  activeStreams?: number;
+  initializing?: number;
+  latestActivityAgeMs?: number;
+  detail: string;
+}
+
+const AUTOMATIC_RELEASE_CUTOVER_QUIET_MS = 30_000;
+const AUTOMATIC_RELEASE_CUTOVER_HEALTH_TIMEOUT_MS = 2_000;
+
+function primaryConnectorHealthEndpoint(config: RecoveryConfig): string | undefined {
+  const localMcpUrl = config.primaryConnectorService?.localMcpUrl?.trim();
+  if (!localMcpUrl) return undefined;
+  try {
+    const url = new URL(localMcpUrl);
+    url.pathname = '/health';
+    url.search = '';
+    url.hash = '';
+    return url.toString();
+  } catch {
+    return undefined;
+  }
+}
+
+export async function probeReleaseCutoverReadiness(
+  config: RecoveryConfig,
+  options: { transport?: RecoveryHttpTransport; quietMs?: number; timeoutMs?: number } = {},
+): Promise<AutomaticReleaseCutoverReadiness> {
+  const healthUrl = primaryConnectorHealthEndpoint(config);
+  if (!healthUrl) return { ready: false, detail: 'primary Connector health endpoint is not configured' };
+  const quietMs = options.quietMs ?? AUTOMATIC_RELEASE_CUTOVER_QUIET_MS;
+  const timeoutMs = options.timeoutMs ?? AUTOMATIC_RELEASE_CUTOVER_HEALTH_TIMEOUT_MS;
+  const transport = options.transport ?? createRecoveryHttpTransport(config.controllerHome);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort('RECOVERY_AUTOMATIC_RELEASE_CUTOVER_HEALTH_TIMEOUT'), timeoutMs);
+  try {
+    const response = await transport.request({
+      url: healthUrl,
+      headers: { accept: 'application/json' },
+      timeoutMs,
+      signal: controller.signal,
+    });
+    if (!response.ok) return { ready: false, detail: `primary Connector health returned HTTP ${response.status}` };
+    let payload: { sessions?: { active?: unknown; activePosts?: unknown; activeStreams?: unknown; initializing?: unknown; latestActivityAgeMs?: unknown } };
+    try {
+      payload = JSON.parse(response.body) as typeof payload;
+    } catch {
+      return { ready: false, detail: 'primary Connector health returned invalid JSON' };
+    }
+    const activeSessions = Number(payload.sessions?.active);
+    const activePosts = Number(payload.sessions?.activePosts);
+    const activeStreams = Number(payload.sessions?.activeStreams);
+    const initializing = Number(payload.sessions?.initializing);
+    const latestActivityAgeMs = Number(payload.sessions?.latestActivityAgeMs);
+    if (
+      !Number.isFinite(activeSessions)
+      || !Number.isFinite(activePosts)
+      || !Number.isFinite(activeStreams)
+      || !Number.isFinite(initializing)
+    ) {
+      return { ready: false, detail: 'primary Connector health omitted bounded session activity counters' };
+    }
+    const evidence = {
+      activeSessions,
+      activePosts,
+      ...(Number.isFinite(activeStreams) ? { activeStreams } : {}),
+      initializing,
+      ...(Number.isFinite(latestActivityAgeMs) ? { latestActivityAgeMs } : {}),
+    };
+    if (activePosts > 0 || activeStreams > 0 || initializing > 0) {
+      return {
+        ready: false,
+        ...evidence,
+        detail: `primary Connector is busy: activePosts=${activePosts}; activeStreams=${activeStreams}; initializing=${initializing}`,
+      };
+    }
+    if (activeSessions > 0 && (!Number.isFinite(latestActivityAgeMs) || latestActivityAgeMs < quietMs)) {
+      const remainingMs = Number.isFinite(latestActivityAgeMs) ? Math.max(0, quietMs - latestActivityAgeMs) : quietMs;
+      return { ready: false, ...evidence, detail: `waiting for ${remainingMs}ms more MCP quiet time before Runtime cutover` };
+    }
+    return {
+      ready: true,
+      ...evidence,
+      detail: activeSessions === 0
+        ? 'primary Connector has no live MCP sessions'
+        : `primary Connector has been MCP-idle for ${latestActivityAgeMs}ms`,
+    };
+  } catch (error) {
+    return { ready: false, detail: `primary Connector health is unavailable: ${error instanceof Error ? error.message : String(error)}` };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 function activePackageConnectorReleaseBinding(config: RecoveryConfig): PackageConnectorReleaseBinding | undefined {
   const configured = config.primaryConnectorService;
   if (!configured || !configured.localMcpUrl?.trim()) return undefined;
@@ -2082,7 +3153,15 @@ function activePackageConnectorReleaseBinding(config: RecoveryConfig): PackageCo
     return undefined;
   }
   if (!existsSync(join(packageRoot, 'src', 'cli', 'index.ts')) || !existsSync(join(packageRoot, 'src', 'runtime', 'shared', 'node-ts-loader.mjs'))) return undefined;
-  return { releaseId: authority.active.releaseId, releaseRoot, packageRoot };
+  const manifest = loadRuntimeReleaseManifest(authority.active.manifestPath, config.controllerHome);
+  return {
+    releaseId: authority.active.releaseId,
+    releaseRoot,
+    packageRoot,
+    ...(manifest.connectorEntrypoint === 'forge-mcp-gateway' && manifest.connectorArtifactIdentity
+      ? { connectorEntrypoint: manifest.connectorEntrypoint, connectorArtifactIdentity: manifest.connectorArtifactIdentity }
+      : {}),
+  };
 }
 
 export function resolveRecoveryPackageConnectorExecutable(
@@ -2263,7 +3342,7 @@ export async function restartPrimaryConnector(
           tunnelRestarted = { ok: result.ok, attempted: true, detail: result.detail, serviceTarget: tunnel.target };
         }
       } else {
-        tunnelRestarted = await ensureOpenAiTunnelRuntimeStarted(primaryTunnel, runCommand);
+        tunnelRestarted = await ensureOpenAiTunnelRuntimeStarted(primaryTunnel, runCommand, tunnelClientWorkingDirectory(config.controllerHome));
       }
       if (!tunnelRestarted?.ok) {
         const detail = tunnelRestarted?.detail ?? 'primary public tunnel service configuration is invalid or unavailable';
@@ -2509,19 +3588,9 @@ async function stopPrimaryRuntimeForReleaseTransition(input: {
   runCommand: CommandRunner;
   runtimeRunning: (config: RecoveryConfig) => boolean;
 }): Promise<PrimaryRuntimeStoppedTransition> {
+  const ownerBeforeStop: RuntimeOwnerRecord | null = readRuntimeOwner(input.config.controllerHome) ?? null;
   const stopped = await stopPrimaryRuntimeServiceOwner(input.service, input.runCommand);
   if (!stopped.ok) return { ok: false, detail: stopped.detail };
-  const runtimeStopped = await waitForPrimaryRuntimeState({
-    config: input.config,
-    expectedRunning: false,
-    timeoutMs: 20_000,
-    now: input.now,
-    wait: input.wait,
-    runtimeRunning: input.runtimeRunning,
-  });
-  if (!runtimeStopped) {
-    return { ok: false, detail: `primary Runtime owner remained live after bounded ${input.service.platform} stop` };
-  }
   const serviceStopped = await waitForPrimaryRuntimeServiceStopped({
     owner: input.service,
     timeoutMs: 20_000,
@@ -2538,6 +3607,35 @@ async function stopPrimaryRuntimeForReleaseTransition(input: {
     };
   }
 
+  let runtimeStopped = await waitForPrimaryRuntimeState({
+    config: input.config,
+    expectedRunning: false,
+    timeoutMs: 5_000,
+    now: input.now,
+    wait: input.wait,
+    runtimeRunning: input.runtimeRunning,
+  });
+  if (!runtimeStopped) {
+    const orphanTermination = await terminateVerifiedRuntimeOwner(input.config.controllerHome, ownerBeforeStop);
+    if (!orphanTermination.ok) {
+      return {
+        ok: false,
+        detail: `primary Runtime owner remained live after service shutdown and bounded identity-verified termination was refused/failed: ${orphanTermination.detail}`,
+      };
+    }
+    runtimeStopped = await waitForPrimaryRuntimeState({
+      config: input.config,
+      expectedRunning: false,
+      timeoutMs: 10_000,
+      now: input.now,
+      wait: input.wait,
+      runtimeRunning: input.runtimeRunning,
+    });
+    if (!runtimeStopped) {
+      return { ok: false, detail: 'primary Runtime owner remained live after verified orphan termination' };
+    }
+  }
+
   let portReleased = await waitForPrimaryRuntimePortReleased({
     config: input.config,
     timeoutMs: 20_000,
@@ -2563,46 +3661,148 @@ async function stopPrimaryRuntimeForReleaseTransition(input: {
       staleListenerCleanup,
     };
   }
-  return { ok: true, detail: `primary Runtime ${input.service.platform} service, owner, and TCP listener are stopped`, staleListenerCleanup };
-}
 
-async function verifyPrimaryRuntimeAfterStart(input: {
-  config: RecoveryConfig;
-  timeoutMs: number;
-  now: () => number;
-  wait: (ms: number) => Promise<void>;
-  verifyLocal: (config: RecoveryConfig) => Promise<VerifyResult>;
-}): Promise<VerifyResult> {
-  const deadline = input.now() + input.timeoutMs;
-  let observed = await input.verifyLocal(input.config);
-  while (!observed.ok && input.now() < deadline) {
-    await input.wait(1_000);
-    observed = await input.verifyLocal(input.config);
+  let ownership = reconcileStoppedRuntimeOwnership(input.config.controllerHome);
+  if (!ownership.ok) {
+    // A Runtime can finish its listener shutdown before its owner process has
+    // exited. The service and port fences above make this a safe, bounded
+    // orphan-termination point; use the same process-identity proof as the
+    // running-state path instead of treating the durable owner as permanent.
+    const orphanTermination = await terminateVerifiedRuntimeOwner(input.config.controllerHome, ownerBeforeStop);
+    if (!orphanTermination.ok) {
+      return {
+        ok: false,
+        detail: `primary Runtime ownership did not quiesce after bounded ${input.service.platform} stop: ${orphanTermination.detail}`,
+        staleListenerCleanup,
+      };
+    }
+    ownership = reconcileStoppedRuntimeOwnership(input.config.controllerHome);
+    if (!ownership.ok) {
+      return {
+        ok: false,
+        detail: `primary Runtime ownership did not quiesce after verified orphan termination: ${ownership.detail}`,
+        staleListenerCleanup,
+      };
+    }
   }
-  return observed;
+  const supervisorSocket = workflowSupervisorSocketPath(resolveWorkflowSupervisorForgeHome(input.config.controllerHome));
+  const supervisor = await reconcileStoppedWorkflowSupervisorSocket(supervisorSocket);
+  if (!supervisor.ok) {
+    return {
+      ok: false,
+      detail: `Workflow Supervisor writer did not quiesce after Runtime stop: ${supervisor.detail}`,
+      staleListenerCleanup,
+    };
+  }
+  return {
+    ok: true,
+    detail: `primary Runtime ${input.service.platform} service, owner, TCP listener, and Workflow Supervisor writer are quiescent`,
+    staleListenerCleanup,
+  };
 }
 
-interface PrimaryRuntimeRebindStartResult {
-  ok: boolean;
-  detail: string;
-  verify: VerifyResult;
-}
+const PRIMARY_RUNTIME_READINESS_POLL_INTERVAL_MS = 250;
 
-/**
- * Complete the only safe restart sequence after release authority changes:
- * rebind the release-pinned launchd contract, start the sole Runtime service,
- * and require whole-Runtime verification. A started-but-unverified Runtime is
- * stopped again so callers never leave a restart loop behind.
- */
-async function rebindStartAndVerifyPrimaryRuntime(input: {
-  config: RecoveryConfig;
-  service: PrimaryRuntimeServiceOwner;
-  runCommand: CommandRunner;
-  now: () => number;
-  wait: (ms: number) => Promise<void>;
-  verifyLocal: (config: RecoveryConfig) => Promise<VerifyResult>;
-  ensureRuntimeLaunchContract?: (controllerHome: string) => void;
+async function observePrimaryRuntimeActivationReadiness(config: RecoveryConfig): Promise<VerifyResult> {
+  const observation = observeRuntimeStatus(config.controllerHome);
+  const authority = releaseAuthority(config);
+  const active = releaseEvidence(config.controllerHome, authority?.active, authority);
+  const previous = releaseEvidence(config.controllerHome, authority?.previous, authority);
+  const runtimeHealthy = observation.running && observation.ready && !observation.stale;
+  const coherent = Boolean(
+    authority
+    && active
+    && observation.snapshot?.releaseId === active.revision
+    && observation.snapshot?.artifactIdentity === active.artifactIdentity
+    && authority.active.workerProtocolVersion === active.workerProtocolVersion,
+  );
+  const probes: VerifyResult['probes'] = {
+    runtime_status: {
+      ok: observation.running && !observation.stale,
+      detail: observation.running
+        ? observation.stale ? 'canonical Runtime status is stale' : 'canonical Runtime owner is live'
+        : 'canonical Runtime is not running',
+    },
+  };
+  const endpoint = observation.snapshot?.endpoint;
+  probes.active_gateway = endpoint
+    ? await probe(createRecoveryHttpTransport(config.controllerHome), runtimeHealthEndpoint(endpoint), 750)
+    : { ok: false, detail: 'canonical Runtime endpoint is unavailable' };
+  return {
+    ok: Boolean(runtimeHealthy && coherent && probes.active_gateway.ok),
+    at: new Date().toISOString(),
+    runtime: {
+      ok: runtimeHealthy,
+      running: observation.running,
+      ready: observation.ready,
+      stale: observation.stale,
+      reasonCodes: [...observation.reasonCodes],
+    },
+    releases: { active, previous, coherent },
+    probes,
+  };
+}
+
+async function waitForPrimaryRuntimeRecoveryHealth(input: {
+  config: RecoveryConfig;
+  timeoutMs: number;
+  now: () => number;
+  wait: (ms: number) => Promise<void>;
+  observeLocal: (config: RecoveryConfig) => Promise<VerifyResult>;
+}): Promise<VerifyResult> {
+  const deadline = input.now() + input.timeoutMs;
+  let observed = await input.observeLocal(input.config);
+  while (!observed.ok && input.now() < deadline) {
+    await input.wait(PRIMARY_RUNTIME_READINESS_POLL_INTERVAL_MS);
+    observed = await input.observeLocal(input.config);
+  }
+  return observed;
+}
+
+async function verifyPrimaryRuntimeAfterStart(input: {
+  config: RecoveryConfig;
+  timeoutMs: number;
+  now: () => number;
+  wait: (ms: number) => Promise<void>;
+  verifyLocal: (config: RecoveryConfig) => Promise<VerifyResult>;
+  observeLocal?: (config: RecoveryConfig) => Promise<VerifyResult>;
+}): Promise<VerifyResult> {
+  const readiness = await waitForPrimaryRuntimeRecoveryHealth({
+    config: input.config,
+    timeoutMs: input.timeoutMs,
+    now: input.now,
+    wait: input.wait,
+    observeLocal: input.observeLocal ?? input.verifyLocal,
+  });
+  if (!readiness.ok) return readiness;
+  // Readiness convergence is intentionally cheap. The acceptance gate remains
+  // one strict whole-Runtime verification after the bounded observation phase.
+  return input.verifyLocal(input.config);
+}
+
+interface PrimaryRuntimeRebindStartResult {
+  ok: boolean;
+  detail: string;
+  verify: VerifyResult;
+}
+
+/**
+ * Complete the only safe restart sequence after release authority changes:
+ * rebind the release-pinned launchd contract, start the sole Runtime service,
+ * and require whole-Runtime verification. A started-but-unverified Runtime is
+ * stopped again so callers never leave a restart loop behind.
+ */
+async function rebindStartAndVerifyPrimaryRuntime(input: {
+  config: RecoveryConfig;
+  service: PrimaryRuntimeServiceOwner;
+  runCommand: CommandRunner;
+  now: () => number;
+  wait: (ms: number) => Promise<void>;
+  verifyLocal: (config: RecoveryConfig) => Promise<VerifyResult>;
+  observeLocal?: (config: RecoveryConfig) => Promise<VerifyResult>;
+  ensureRuntimeLaunchContract?: (controllerHome: string) => void;
   beforeStart?: () => void;
+  afterRuntimeReady?: () => Promise<{ ok: boolean; detail: string }>;
   contractFailureContext?: string;
   timeoutMs: number;
   successDetail: string;
@@ -2648,13 +3848,42 @@ async function rebindStartAndVerifyPrimaryRuntime(input: {
   if (!started.ok) {
     return { ok: false, detail: started.detail, verify: await input.verifyLocal(input.config) };
   }
-  const verify = await verifyPrimaryRuntimeAfterStart({
-    config: input.config,
+  const observeLocal = input.observeLocal ?? input.verifyLocal;
+  const runtimeOnlyConfig: RecoveryConfig = input.afterRuntimeReady
+    ? {
+        ...input.config,
+        publicMcpUrl: undefined,
+        primaryConnectorService: undefined,
+        primaryPublicTunnelService: undefined,
+      }
+    : input.config;
+  const runtimeHealth = await waitForPrimaryRuntimeRecoveryHealth({
+    config: runtimeOnlyConfig,
     timeoutMs: input.timeoutMs,
     now: input.now,
     wait: input.wait,
-    verifyLocal: input.verifyLocal,
+    observeLocal,
   });
+  if (!runtimeHealth.ok) {
+    await stopPrimaryRuntimeServiceOwner(input.service, input.runCommand);
+    return {
+      ok: false,
+      detail: input.afterRuntimeReady
+        ? 'release transition candidate Runtime did not reach local readiness before Connector rebinding'
+        : 'release transition candidate Runtime did not reach local readiness',
+      verify: runtimeHealth,
+    };
+  }
+  if (input.afterRuntimeReady) {
+    const postReady = await input.afterRuntimeReady();
+    if (!postReady.ok) {
+      await stopPrimaryRuntimeServiceOwner(input.service, input.runCommand);
+      return { ok: false, detail: postReady.detail, verify: await input.verifyLocal(input.config) };
+    }
+  }
+  // Readiness has converged and any Connector rebind has completed. Strict
+  // acceptance runs once here; there is no second readiness polling phase.
+  const verify = await input.verifyLocal(input.config);
   if (verify.ok) return { ok: true, detail: input.successDetail, verify };
   await stopPrimaryRuntimeServiceOwner(input.service, input.runCommand);
   return {
@@ -2669,8 +3898,10 @@ export async function restartPrimaryRuntime(
   dependencies: PrimaryRuntimeRecoveryDependencies = {},
 ): Promise<PrimaryRuntimeRestartResult> {
   const verifyLocal = dependencies.verifyLocal ?? verifyLocalRuntime;
+  const observeLocal = dependencies.observeLocal ?? (dependencies.verifyLocal ? dependencies.verifyLocal : observePrimaryRuntimeActivationReadiness);
   const initial = await verifyLocal(config);
-  if (initial.ok) return { ok: true, attempted: false, noOp: true, detail: 'Canonical Forge Runtime is already healthy', verify: initial };
+  const forceHealthyRestart = dependencies.forceHealthyRestart === true;
+  if (initial.ok && !forceHealthyRestart) return { ok: true, attempted: false, noOp: true, detail: 'Canonical Forge Runtime is already healthy', verify: initial };
   const platform = dependencies.platform ?? process.platform;
   const uid = await (dependencies.currentUid ?? currentUid)();
   const service = primaryRuntimeServiceOwner(config, platform, uid);
@@ -2681,8 +3912,52 @@ export async function restartPrimaryRuntime(
   const wait = dependencies.sleep ?? sleep;
   const locked = await withLock(config, { action: 'restart_primary_runtime' }, async () => {
     const before = await verifyLocal(config);
-    if (before.ok) return { ok: true, attempted: false, noOp: true, detail: 'Canonical Forge Runtime recovered before restart', serviceTarget: service.target, verify: before } satisfies PrimaryRuntimeRestartResult;
-    const started = await ensurePrimaryRuntimeServiceStarted(service, dependencies.runCommand ?? command, 'restart');
+    if (before.ok && !forceHealthyRestart) return { ok: true, attempted: false, noOp: true, detail: 'Canonical Forge Runtime recovered before restart', serviceTarget: service.target, verify: before } satisfies PrimaryRuntimeRestartResult;
+    const runCommand = dependencies.runCommand ?? command;
+    const runtimeRunning = dependencies.runtimeRunning ?? ((value: RecoveryConfig) => observeRuntimeStatus(value.controllerHome).running);
+    const stopped = await stopPrimaryRuntimeForReleaseTransition({
+      config,
+      service,
+      now,
+      wait,
+      runCommand,
+      runtimeRunning,
+    });
+    if (!stopped.ok) {
+      audit(config, 'primary_runtime_restart_quiescence_failed', { serviceTarget: service.target, detail: stopped.detail });
+      return { ok: false, attempted: true, detail: stopped.detail, serviceTarget: service.target, verify: before } satisfies PrimaryRuntimeRestartResult;
+    }
+    const activeAuthority = releaseAuthority(config);
+    if (activeAuthority) {
+      const repairConnectorBinding = dependencies.repairPrimaryConnectorBinding
+        ?? ((value: RecoveryConfig) => repairPrimaryConnectorBinding(value, platform));
+      const rebound = await rebindStartAndVerifyPrimaryRuntime({
+        config,
+        service,
+        runCommand,
+        now,
+        wait,
+        verifyLocal,
+        observeLocal,
+        ensureRuntimeLaunchContract: dependencies.ensureRuntimeLaunchContract,
+        contractFailureContext: 'before restart',
+        timeoutMs: configuredPrimaryRuntimeService(config).postRestartVerifyTimeoutMs ?? 30_000,
+        successDetail: 'Canonical Forge Runtime restarted and passed whole-Runtime verification',
+        afterRuntimeReady: async () => {
+          const connector = await repairConnectorBinding(config);
+          return connector.ok
+            ? { ok: true, detail: connector.detail }
+            : { ok: false, detail: `persistent Connector binding failed after Runtime readiness: ${connector.detail}` };
+        },
+      });
+      if (rebound.ok) {
+        audit(config, 'primary_runtime_restart_succeeded', { serviceTarget: service.target, release: rebound.verify.releases.active?.revision, launchContractRebound: true });
+        return { ok: true, attempted: true, detail: rebound.detail, serviceTarget: service.target, verify: rebound.verify } satisfies PrimaryRuntimeRestartResult;
+      }
+      audit(config, 'primary_runtime_restart_unverified', { serviceTarget: service.target, reasonCodes: rebound.verify.runtime.reasonCodes, detail: rebound.detail, launchContractRebound: true });
+      return { ok: false, attempted: true, detail: rebound.detail, serviceTarget: service.target, verify: rebound.verify } satisfies PrimaryRuntimeRestartResult;
+    }
+    const started = await ensurePrimaryRuntimeServiceStarted(service, runCommand, 'restart');
     if (!started.ok) {
       audit(config, 'primary_runtime_restart_failed', { serviceTarget: service.target, detail: started.detail });
       return { ok: false, attempted: true, detail: started.detail, serviceTarget: service.target, verify: before } satisfies PrimaryRuntimeRestartResult;
@@ -2693,6 +3968,7 @@ export async function restartPrimaryRuntime(
       now,
       wait,
       verifyLocal,
+      observeLocal,
     });
     if (after.ok) {
       audit(config, 'primary_runtime_restart_succeeded', { serviceTarget: service.target, release: after.releases.active?.revision });
@@ -2711,8 +3987,63 @@ export async function recoverPrimaryRuntime(
   dependencies: PrimaryRuntimeRecoveryDependencies = {},
 ): Promise<PrimaryRuntimeRecoveryResult> {
   const verifyLocal = dependencies.verifyLocal ?? verifyLocalRuntime;
+  const observeLocal = dependencies.observeLocal ?? (dependencies.verifyLocal ? dependencies.verifyLocal : observePrimaryRuntimeActivationReadiness);
   const initial = await verifyLocal(config);
   if (initial.ok) return { ok: true, attempted: false, noOp: true, detail: 'Canonical Forge Runtime recovered before rollback', verify: initial };
+
+  const releaseAuthoritySnapshot = releaseAuthority(config);
+  if (releaseAuthoritySnapshot) {
+    const inventory = listCompleteReleaseSessions(config.controllerHome);
+    if (inventory.invalidSessionFiles.length > 0) {
+      return {
+        ok: false,
+        attempted: false,
+        noOp: true,
+        detail: `RELEASE_SESSION_INVENTORY_INCOMPLETE: invalid=${inventory.invalidSessionFiles.join(',') || 'none'}`,
+        verify: initial,
+      };
+    }
+    const matching = inventory.sessions.filter((session) => (
+      ['cutover_attempting', 'cutover_committed', 'soaking'].includes(session.phase)
+      && session.transaction
+      && session.candidateRelease?.releaseId === releaseAuthoritySnapshot.active.releaseId
+      && session.candidateRelease.artifactIdentity === releaseAuthoritySnapshot.active.artifactIdentity
+    ));
+    if (matching.length > 1) {
+      return {
+        ok: false,
+        attempted: false,
+        noOp: true,
+        detail: `RELEASE_SESSION_MULTIPLE_ACTIVE_FOR_RUNTIME: ${matching.map((session) => session.sessionId).join(',')}`,
+        verify: initial,
+      };
+    }
+    const session = matching[0];
+    if (session) {
+      const sessionRollback = await rollbackConfiguredRuntimeReleaseSession(
+        config,
+        session.sessionId,
+        dependencies,
+        `recover-primary-runtime:${session.transaction!.operationId}`,
+      );
+      const after = await verifyLocal(config);
+      const rollback: RollbackResult = {
+        ok: sessionRollback.ok,
+        ...(sessionRollback.noOp === true ? { noOp: true } : {}),
+        detail: sessionRollback.detail,
+        verify: after,
+      };
+      return {
+        ok: sessionRollback.ok,
+        attempted: sessionRollback.attempted,
+        ...(sessionRollback.noOp === true ? { noOp: true } : {}),
+        detail: sessionRollback.detail,
+        rollback,
+        verify: after,
+      };
+    }
+  }
+
   const platform = dependencies.platform ?? process.platform;
   const uid = await (dependencies.currentUid ?? currentUid)();
   const service = primaryRuntimeServiceOwner(config, platform, uid);
@@ -2757,6 +4088,7 @@ export async function recoverPrimaryRuntime(
       now,
       wait,
       verifyLocal,
+      observeLocal,
       ensureRuntimeLaunchContract: dependencies.ensureRuntimeLaunchContract,
       contractFailureContext: 'after rollback',
       timeoutMs: configuredPrimaryRuntimeService(config).postRestartVerifyTimeoutMs ?? 45_000,
@@ -2829,17 +4161,17 @@ function validateRuntimeReleaseCandidate(
 
 /**
  * Activate an already staged and validated immutable Runtime release without
- * depending on the primary Runtime execution plane. The transaction mirrors
- * recoverPrimaryRuntime: stop the complete canonical service, atomically switch
- * active/previous whole-release authority (with a local SQLite backup), start
- * the one Runtime service, require whole-Runtime verification, and on failure
- * restore the previous whole release and its SQLite backup before restarting.
+ * depending on the primary Runtime execution plane. RuntimeReleaseAuthority
+ * changes only physical active/previous identity plus the SQLite backup; when a
+ * ReleaseSession owns the cutover, its transaction snapshot is the sole durable
+ * semantic rollback authority through soak.
  */
-export async function activateRuntimeRelease(
+async function activateRuntimeReleaseInternal(
   config: RecoveryConfig,
   candidateManifestPath: string,
   dependencies: PrimaryRuntimeRecoveryDependencies = {},
   guard: RuntimeReleaseActivationGuard = {},
+  heldRecoveryLock?: RecoveryLock,
 ): Promise<RuntimeReleaseActivationResult> {
   let candidate: { manifest: RuntimeReleaseManifest; releaseRoot: string; manifestPath: string };
   try {
@@ -2849,6 +4181,56 @@ export async function activateRuntimeRelease(
     audit(config, 'runtime_release_activation_candidate_invalid', { detail, ...(guard.requestId ? { requestId: guard.requestId } : {}) });
     return { ok: false, attempted: false, noOp: true, detail };
   }
+  if (candidate.manifest.deploymentScope === 'portable' && !guard.requiredPinnedReleaseRevision) {
+    const releaseSessionId = guard.releaseSessionId?.trim();
+    if (!releaseSessionId) {
+      const detail = 'RELEASE_SESSION_CUTOVER_REQUIRED: portable Runtime candidates cannot activate outside an exact ReleaseSession';
+      audit(config, 'runtime_release_activation_release_session_required', {
+        candidateRevision: candidate.manifest.releaseId,
+        ...(guard.requestId ? { requestId: guard.requestId } : {}),
+      });
+      return { ok: false, attempted: false, noOp: true, detail };
+    }
+    let session: ReleaseSession | undefined;
+    try {
+      session = readReleaseSession(config.controllerHome, releaseSessionId);
+    } catch {
+      session = undefined;
+    }
+    if (!session) {
+      return { ok: false, attempted: false, noOp: true, detail: 'RELEASE_SESSION_MISSING' };
+    }
+    if (session.phase !== 'cutover_attempting') {
+      return {
+        ok: false,
+        attempted: false,
+        noOp: true,
+        detail: `RELEASE_SESSION_NOT_CUTOVER_ATTEMPTING: ${session.phase}`,
+      };
+    }
+    if (resolve(session.stable.controllerHome) !== resolve(config.controllerHome)) {
+      return { ok: false, attempted: false, noOp: true, detail: 'RELEASE_SESSION_STABLE_LANE_MISMATCH' };
+    }
+    const bound = session.candidateRelease;
+    if (!bound) {
+      return { ok: false, attempted: false, noOp: true, detail: 'RELEASE_SESSION_CANDIDATE_RELEASE_REQUIRED' };
+    }
+    const observedManifestSha256 = createHash('sha256').update(readFileSync(candidate.manifestPath)).digest('hex');
+    const observedTreeSha256 = runtimeReleaseTreeSha256(candidate.releaseRoot);
+    if (
+      bound.releaseId !== candidate.manifest.releaseId
+      || bound.artifactIdentity !== candidate.manifest.artifactIdentity
+      || bound.manifestSha256 !== observedManifestSha256
+      || bound.treeSha256 !== observedTreeSha256
+    ) {
+      return { ok: false, attempted: false, noOp: true, detail: 'RELEASE_SESSION_CANDIDATE_IDENTITY_MISMATCH' };
+    }
+    try {
+      assertStableReleaseSessionIdentityCurrent(config, session.stableRelease);
+    } catch (error) {
+      return { ok: false, attempted: false, noOp: true, detail: error instanceof Error ? error.message : String(error) };
+    }
+  }
   const platform = dependencies.platform ?? process.platform;
   const uid = await (dependencies.currentUid ?? currentUid)();
   const service = primaryRuntimeServiceOwner(config, platform, uid);
@@ -2860,17 +4242,25 @@ export async function activateRuntimeRelease(
   const wait = dependencies.sleep ?? sleep;
   const runtimeRunning = dependencies.runtimeRunning ?? ((value: RecoveryConfig) => observeRuntimeStatus(value.controllerHome).running);
   const verifyLocal = dependencies.verifyLocal ?? verifyLocalRuntime;
+  const observeLocal = dependencies.observeLocal ?? (dependencies.verifyLocal ? dependencies.verifyLocal : observePrimaryRuntimeActivationReadiness);
   const repairConnectorBinding = dependencies.repairPrimaryConnectorBinding
     ?? ((value: RecoveryConfig) => repairPrimaryConnectorBinding(value, platform));
   const operationId = `recovery-activate-runtime-${Date.now()}-${randomUUID().slice(0, 8)}`;
   const lockRequestId = guard.requestId?.trim() || operationId;
-  const locked = await withLock(config, { action: 'activate_runtime_release', requestId: lockRequestId }, async () => {
+  const activateUnderRecoveryAuthority = async () => {
     // Re-read authority only after acquiring the mutation lock. A caller may
     // have selected its candidate before another activation completed; stale
     // decisions must fail before bootout/publish rather than overwrite the newer
     // active release.
     const current = releaseAuthority(config);
     const previousActive = current?.active;
+    if (guard.requiredPinnedReleaseRevision) {
+      const pinned = runtimePin(config)?.release;
+      if (!pinned || pinned.revision !== guard.requiredPinnedReleaseRevision || pinned.revision !== candidate.manifest.releaseId) {
+        const detail = `RUNTIME_PIN_AUTHORITY_CHANGED: expected ${guard.requiredPinnedReleaseRevision}, observed ${pinned?.revision ?? 'none'}`;
+        return { ok: false, attempted: false, noOp: true, detail, operationId } satisfies RuntimeReleaseActivationResult;
+      }
+    }
     const expectedRevision = guard.expectedAuthorityRevision;
     const expectedActiveReleaseId = typeof guard.expectedActiveReleaseId === 'string' ? guard.expectedActiveReleaseId.trim() : guard.expectedActiveReleaseId;
     if (expectedRevision !== undefined && (expectedRevision === null ? current !== undefined : current?.revision !== expectedRevision)) {
@@ -2958,7 +4348,7 @@ export async function activateRuntimeRelease(
         } satisfies RuntimeReleaseActivationResult;
       }
     }
-    if (current?.previous?.releaseId === candidate.manifest.releaseId) {
+    if (!guard.allowPreviousRelease && current?.previous?.releaseId === candidate.manifest.releaseId) {
       const detail = 'RUNTIME_RELEASE_REVERSE_ACTIVATION_REQUIRES_ROLLBACK: activate_runtime_release cannot replace the active release with current.previous; use rollback_previous or recover_primary_runtime';
       audit(config, 'runtime_release_reverse_activation_rejected', {
         operationId,
@@ -2969,9 +4359,23 @@ export async function activateRuntimeRelease(
       });
       return { ok: false, attempted: false, noOp: true, detail, operationId } satisfies RuntimeReleaseActivationResult;
     }
-    const before = await verifyLocal(config);
+    // Snapshot Stable A while it is still serving. The release store keeps a
+    // database-wide SQLite data_version observer open across this snapshot and
+    // the stop boundary. Any intervening commit invalidates the speculative
+    // snapshot and publish falls back to a stopped-state backup.
+    let preparedDatabaseBackup;
+    try {
+      preparedDatabaseBackup = current
+        ? prepareRuntimeReleaseDatabaseBackup(config.controllerHome, operationId)
+        : undefined;
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : 'runtime release rollback database preparation failed';
+      audit(config, 'runtime_release_activation_backup_prepare_failed', { serviceTarget: service.target, operationId, detail });
+      return { ok: false, attempted: false, noOp: true, detail, serviceTarget: service.target, verify: await observeLocal(config) } satisfies RuntimeReleaseActivationResult;
+    }
     const stopped = await stopPrimaryRuntimeForReleaseTransition({ config, service, now, wait, runCommand, runtimeRunning });
     if (!stopped.ok) {
+      preparedDatabaseBackup?.discard();
       const action = stopped.detail.startsWith('primary Runtime bootout failed')
         ? 'runtime_release_activation_stop_failed'
         : 'runtime_release_activation_stop_unverified';
@@ -2989,7 +4393,13 @@ export async function activateRuntimeRelease(
     }
     let committed: RuntimeReleaseAuthority;
     try {
-      committed = publishRuntimeRelease(config.controllerHome, candidate.manifestPath, operationId);
+      committed = publishRuntimeRelease(
+        config.controllerHome,
+        candidate.manifestPath,
+        operationId,
+        undefined,
+        preparedDatabaseBackup,
+      );
     } catch (error) {
       const detail = error instanceof Error ? error.message : 'runtime release authority publish failed';
       audit(config, 'runtime_release_activation_publish_failed', { serviceTarget: service.target, operationId, detail });
@@ -3000,65 +4410,113 @@ export async function activateRuntimeRelease(
       audit(config, 'runtime_release_activation_commit_mismatch', { serviceTarget: service.target, operationId });
       return { ok: false, attempted: true, detail, serviceTarget: service.target, verify: await verifyLocal(config) } satisfies RuntimeReleaseActivationResult;
     }
-    // The Connector is independently supervised, but its executable is part of
-    // this immutable Runtime release. Rebind it immediately after publishing
-    // authority and before starting the candidate: full Runtime verification
-    // includes the Connector and must never observe a stale previous release.
-    const candidateConnectorBinding = await repairConnectorBinding(config);
-    let storageMigration: ControllerHomeStorageMigration | undefined;
+
+    // Once the physical authority switch is durable, persist exact Stable A
+    // rollback identity before Candidate B starts. A later start/Connector/verify
+    // failure therefore never precedes ReleaseSession rollback authority.
+    let releaseSessionTransactionPersisted = false;
     let activationFailureDetail: string | undefined;
-    let activated: PrimaryRuntimeRebindStartResult;
-    if (!candidateConnectorBinding.ok) {
-      const detail = `persistent Connector binding failed before Runtime activation: ${candidateConnectorBinding.detail}`;
-      activationFailureDetail = detail;
-      audit(config, 'runtime_release_activation_connector_binding_failed', {
-        serviceTarget: service.target,
-        operationId,
-        requestId: lockRequestId,
-        detail: candidateConnectorBinding.detail,
-      });
-      activated = { ok: false, detail, verify: await verifyLocal(config) };
-    } else {
-      activated = await rebindStartAndVerifyPrimaryRuntime({
-        config,
-        service,
-        runCommand,
-        now,
-        wait,
-        verifyLocal,
-        timeoutMs: configuredPrimaryRuntimeService(config).postRestartVerifyTimeoutMs ?? 60_000,
-        successDetail: 'requested Runtime release started and passed whole-Runtime verification',
-        beforeStart: () => {
-          storageMigration = migrateStoppedRepoLocalControllerHomeStorage(config.controllerHome, platform);
-          if (storageMigration.migrated) {
-            audit(config, 'runtime_controller_home_noindex_migrated', {
-              serviceTarget: service.target,
-              operationId,
-              logicalHome: storageMigration.logicalHome,
-              physicalHome: storageMigration.physicalHome,
-            });
-          }
-        },
-      });
+    if (!guard.preserveDatabaseOnFailure && guard.releaseSessionId?.trim()) {
+      try {
+        const session = readReleaseSession(config.controllerHome, guard.releaseSessionId.trim());
+        if (
+          committed.operationId !== operationId
+          || !committed.previous?.databaseBackup
+          || !session
+          || session.phase !== 'cutover_attempting'
+        ) throw new Error('RELEASE_SESSION_TRANSACTION_CAPTURE_PRECONDITION_FAILED');
+        recordReleaseSessionTransaction({
+          controllerHome: config.controllerHome,
+          sessionId: session.sessionId,
+          expectedRevision: session.revision,
+          transaction: {
+            schemaVersion: 1,
+            operationId,
+            candidateReleaseId: candidate.manifest.releaseId,
+            cutoverAuthorityRevision: committed.revision,
+            rollbackRelease: committed.previous,
+            startedAt: committed.committedAt,
+          },
+        });
+        releaseSessionTransactionPersisted = true;
+      } catch (error) {
+        activationFailureDetail = `ReleaseSession rollback transaction capture failed before Runtime start: ${error instanceof Error ? error.message : String(error)}`;
+        audit(config, 'release_session_transaction_capture_failed', {
+          serviceTarget: service.target,
+          operationId,
+          requestId: lockRequestId,
+          releaseSessionId: guard.releaseSessionId.trim(),
+          detail: activationFailureDetail,
+        });
+      }
     }
+
+    // The Connector is independently supervised, but its package snapshot proxies
+    // the Canonical Runtime. Starting/rebinding it while the Runtime is stopped
+    // creates a dependency cycle: Connector readiness waits on a Runtime that has
+    // not started yet. Start the candidate first, require Runtime-only readiness,
+    // then rebind the Connector and finally require whole-Runtime verification.
+    let candidateConnectorBinding: { ok: boolean; attempted: boolean; noOp?: boolean; detail: string } | undefined;
+    let storageMigration: ControllerHomeStorageMigration | undefined;
+    const activated = activationFailureDetail
+      ? { ok: false, detail: activationFailureDetail, verify: await observeLocal(config) }
+      : await rebindStartAndVerifyPrimaryRuntime({
+      config,
+      service,
+      runCommand,
+      now,
+      wait,
+      verifyLocal,
+      observeLocal,
+      timeoutMs: configuredPrimaryRuntimeService(config).postRestartVerifyTimeoutMs ?? 60_000,
+      successDetail: 'requested Runtime release started and passed whole-Runtime verification',
+      beforeStart: () => {
+        storageMigration = migrateStoppedRepoLocalControllerHomeStorage(config.controllerHome, platform);
+        if (storageMigration.migrated) {
+          audit(config, 'runtime_controller_home_noindex_migrated', {
+            serviceTarget: service.target,
+            operationId,
+            logicalHome: storageMigration.logicalHome,
+            physicalHome: storageMigration.physicalHome,
+          });
+        }
+      },
+      afterRuntimeReady: async () => {
+        candidateConnectorBinding = await repairConnectorBinding(config);
+        if (candidateConnectorBinding.ok) return { ok: true, detail: candidateConnectorBinding.detail };
+        const detail = `persistent Connector binding failed after Runtime readiness: ${candidateConnectorBinding.detail}`;
+        activationFailureDetail = detail;
+        audit(config, 'runtime_release_activation_connector_binding_failed', {
+          serviceTarget: service.target,
+          operationId,
+          requestId: lockRequestId,
+          detail: candidateConnectorBinding.detail,
+        });
+        return { ok: false, detail };
+      },
+    });
     let after = activated.verify;
     if (activated.ok && after.releases.active?.revision === candidate.manifest.releaseId) {
       audit(config, 'runtime_release_activation_succeeded', {
-        serviceTarget: service.target,
-        operationId,
-        requestId: lockRequestId,
-        activeRevision: after.releases.active?.revision,
-        expectedAuthorityRevision: guard.expectedAuthorityRevision,
-        expectedActiveReleaseId: guard.expectedActiveReleaseId,
-        controllerHomeStorageMigrated: storageMigration?.migrated === true,
-        connectorBindingRepaired: candidateConnectorBinding.attempted,
+          serviceTarget: service.target,
+          operationId,
+          requestId: lockRequestId,
+          activeRevision: after.releases.active?.revision,
+          expectedAuthorityRevision: guard.expectedAuthorityRevision,
+          expectedActiveReleaseId: guard.expectedActiveReleaseId,
+          controllerHomeStorageMigrated: storageMigration?.migrated === true,
+          connectorBindingRepaired: candidateConnectorBinding?.attempted === true,
+          releaseSessionTransactionPersisted,
+          ...(guard.releaseSessionId?.trim() ? { releaseSessionId: guard.releaseSessionId.trim() } : {}),
       });
       return {
         ok: true,
         attempted: true,
-        detail: storageMigration?.migrated
-          ? 'requested Runtime release activated, Controller Home migrated to .noindex storage, persistent Connector rebound, and whole-Runtime verification passed'
-          : 'requested Runtime release activated, persistent Connector rebound, and whole-Runtime verification passed',
+        detail: releaseSessionTransactionPersisted
+          ? 'requested Runtime release activated and verified; physical activation committed and ReleaseSession owns rollback authority through soak'
+          : storageMigration?.migrated
+            ? 'requested Runtime release activated, Controller Home migrated to .noindex storage, persistent Connector rebound, and whole-Runtime verification passed'
+            : 'requested Runtime release activated, persistent Connector rebound, and whole-Runtime verification passed',
         serviceTarget: service.target,
         operationId,
         verify: after,
@@ -3079,8 +4537,9 @@ export async function activateRuntimeRelease(
       audit(config, 'runtime_release_activation_commit_mismatch', { serviceTarget: service.target, operationId, detail: activationFailureDetail });
     }
 
-    // Activation failed: stop, restore the previous whole release and its SQLite
-    // backup, restart the one service, and require verification again.
+    // Activation failed: stop and restore the previous whole release. SQLite
+    // rollback is allowed only when the live durable-mutation generation still
+    // equals the captured backup; newer Controller Home state is preserved.
     let rollback: RollbackResult;
     const rollbackStop = await stopPrimaryRuntimeForReleaseTransition({ config, service, now, wait, runCommand, runtimeRunning });
     if (!rollbackStop.ok) {
@@ -3092,8 +4551,25 @@ export async function activateRuntimeRelease(
       };
     } else {
       try {
-        const rollbackOperationId = `recovery-activate-runtime-rollback-${Date.now()}-${randomUUID().slice(0, 8)}`;
-        const restored = rollbackRuntimeRelease(config.controllerHome, rollbackOperationId);
+        const rollbackOperationId = guard.preserveDatabaseOnFailure
+          ? `recovery-activate-runtime-rollback-${Date.now()}-${randomUUID().slice(0, 8)}`
+          : operationId;
+        let rollbackDatabaseDisposition: RuntimeDatabaseRollbackDisposition | 'preserved_by_guard' = 'preserved_by_guard';
+        const physicallyRestored = guard.preserveDatabaseOnFailure && previousActive
+          ? publishRuntimeRelease(config.controllerHome, previousActive.manifestPath, rollbackOperationId)
+          : (() => {
+            const rollbackResult = rollbackRuntimeReleaseWithResult(config.controllerHome, rollbackOperationId);
+            rollbackDatabaseDisposition = rollbackResult.databaseDisposition;
+            return rollbackResult.authority;
+          })();
+        const restored = current && previousActive
+          ? reconcileFailedRuntimeReleaseActivationAuthority(
+              config.controllerHome,
+              current,
+              candidate.manifest.releaseId,
+              rollbackOperationId,
+            )
+          : physicallyRestored;
         if (storageMigration?.migrated) {
           rollbackStoppedRepoLocalControllerHomeStorage(storageMigration);
           audit(config, 'runtime_controller_home_noindex_migration_rolled_back', {
@@ -3112,6 +4588,7 @@ export async function activateRuntimeRelease(
         ) {
           throw new Error('RECOVERY_RUNTIME_RELEASE_ROLLBACK_AUTHORITY_MISMATCH');
         }
+        let rollbackConnectorBinding: { ok: boolean; attempted: boolean; noOp?: boolean; detail: string } | undefined;
         const restarted = await rebindStartAndVerifyPrimaryRuntime({
           config,
           service,
@@ -3119,25 +4596,31 @@ export async function activateRuntimeRelease(
           now,
           wait,
           verifyLocal,
+          observeLocal,
           contractFailureContext: 'after rollback',
           timeoutMs: configuredPrimaryRuntimeService(config).postRestartVerifyTimeoutMs ?? 60_000,
-          successDetail: 'previous whole-Runtime release and SQLite backup restored, restarted, and verified',
+          successDetail: rollbackDatabaseDisposition === 'restored_backup'
+            ? 'previous whole-Runtime release and unchanged SQLite backup restored, restarted, rebound, and verified'
+            : 'previous Runtime release restored while live SQLite state was preserved, restarted, rebound, and verified',
+          afterRuntimeReady: async () => {
+            rollbackConnectorBinding = await repairConnectorBinding(config);
+            if (rollbackConnectorBinding.ok) return { ok: true, detail: rollbackConnectorBinding.detail };
+            audit(config, 'runtime_release_activation_rollback_connector_binding_failed', {
+              serviceTarget: service.target,
+              operationId,
+              rollbackOperationId,
+              detail: rollbackConnectorBinding.detail,
+            });
+            return {
+              ok: false,
+              detail: `previous persistent Connector binding failed after rollback Runtime readiness: ${rollbackConnectorBinding.detail}`,
+            };
+          },
         });
-        const connectorBinding = restarted.ok ? await repairConnectorBinding(config) : undefined;
-        if (connectorBinding && !connectorBinding.ok) {
-          audit(config, 'runtime_release_activation_rollback_connector_binding_failed', {
-            serviceTarget: service.target,
-            operationId,
-            rollbackOperationId,
-            detail: connectorBinding.detail,
-          });
-        }
         rollback = {
-          ok: restarted.ok && (connectorBinding?.ok ?? true),
+          ok: restarted.ok,
           operationId: rollbackOperationId,
-          detail: connectorBinding && !connectorBinding.ok
-            ? `${restarted.detail}; previous persistent Connector binding failed: ${connectorBinding.detail}`
-            : restarted.detail,
+          detail: restarted.detail,
           verify: restarted.verify,
         };
       } catch (error) {
@@ -3164,80 +4647,1950 @@ export async function activateRuntimeRelease(
       rollback,
       verify: after,
     } satisfies RuntimeReleaseActivationResult;
-  });
+  };
+
+  if (heldRecoveryLock) {
+    const live = liveRecoveryMutationLock(config);
+    if (
+      !live
+      || live.instanceId !== heldRecoveryLock.instanceId
+      || live.pid !== heldRecoveryLock.pid
+      || live.processStartTime !== heldRecoveryLock.processStartTime
+    ) {
+      return {
+        ok: false,
+        attempted: false,
+        noOp: true,
+        detail: 'RECOVERY_OPERATION_LOCK_AUTHORITY_CHANGED',
+        serviceTarget: service.target,
+        verify: await verifyStableRuntime(config),
+      };
+    }
+    return activateUnderRecoveryAuthority();
+  }
+
+  const locked = await withLock(
+    config,
+    { action: 'activate_runtime_release', requestId: lockRequestId },
+    async () => activateUnderRecoveryAuthority(),
+  );
   if (!locked.acquired) {
     return { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner), serviceTarget: service.target, verify: await verifyStableRuntime(config) };
   }
   return locked.value;
 }
 
-export interface ConfiguredRuntimeActivationDependencies {
-  stage?: typeof stageRuntimeReleaseFromCandidateSource;
-  activate?: (config: RecoveryConfig, manifestPath: string, guard: RuntimeReleaseActivationGuard) => Promise<RuntimeReleaseActivationResult>;
+export async function activateRuntimeRelease(
+  config: RecoveryConfig,
+  candidateManifestPath: string,
+  dependencies: PrimaryRuntimeRecoveryDependencies = {},
+  guard: RuntimeReleaseActivationGuard = {},
+): Promise<RuntimeReleaseActivationResult> {
+  return activateRuntimeReleaseInternal(config, candidateManifestPath, dependencies, guard);
 }
 
-export async function stageAndActivateConfiguredRuntimeRelease(
+export async function activatePinnedRuntimeRelease(
   config: RecoveryConfig,
-  dependencies: ConfiguredRuntimeActivationDependencies = {},
-  requestId?: string,
-): Promise<ConfiguredRuntimeActivationResult> {
-  const sourceRoot = config.primaryRuntimeSourceRoot?.trim();
-  if (!sourceRoot) {
-    return { ok: false, attempted: false, noOp: true, detail: 'primary Runtime source root is not configured in standalone Recovery' };
-  }
-  const sourceRepositoryId = config.primaryRuntimeSourceRepositoryId?.trim();
-  if (!sourceRepositoryId) {
-    return { ok: false, attempted: false, noOp: true, detail: 'primary Runtime source repository id is not configured in standalone Recovery' };
-  }
-  // Capture the base before staging. Staging can take long enough for another
-  // activation to win; the later publish must prove this base is still current.
-  const expectedAuthority = releaseAuthority(config);
-  const stagedAttempt = await withLock(config, {
-    action: 'stage_and_activate_runtime_release',
-    ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
+  dependencies: PrimaryRuntimeRecoveryDependencies = {},
+  guard: RuntimeReleaseActivationGuard = {},
+): Promise<RuntimeReleaseActivationResult> {
+  let pin: RuntimePinStore | undefined;
+  try { pin = runtimePin(config); }
+  catch (error) { return { ok: false, attempted: false, noOp: true, detail: error instanceof Error ? error.message : String(error) }; }
+  if (!pin) return { ok: false, attempted: false, noOp: true, detail: 'RUNTIME_PIN_REQUIRED: no Runtime release is pinned' };
+  let candidate: { manifest: RuntimeReleaseManifest; releaseRoot: string; manifestPath: string };
+  try { candidate = validateRuntimeReleaseCandidate(config, pin.release.path); }
+  catch (error) { return { ok: false, attempted: false, noOp: true, detail: error instanceof Error ? error.message : String(error) }; }
+  if (candidate.manifest.deploymentScope === 'portable') {
+    return {
+      ok: false,
+      attempted: false,
+      noOp: true,
+      detail: 'RUNTIME_PIN_PORTABLE_RELEASE_FORBIDDEN: portable source candidates require a verified Recovery ReleaseSession',
+    };
+  }
+  let observed: ReleaseEvidence;
+  try { observed = releaseEvidenceForPin(config, candidate); }
+  catch (error) { return { ok: false, attempted: false, noOp: true, detail: error instanceof Error ? error.message : String(error) }; }
+  if (observed.revision !== pin.release.revision || observed.artifactIdentity !== pin.release.artifactIdentity || observed.manifestSha256 !== pin.release.manifestSha256) {
+    return { ok: false, attempted: false, noOp: true, detail: 'RUNTIME_PIN_IDENTITY_MISMATCH: pinned immutable release changed on disk' };
+  }
+  return activateRuntimeRelease(config, pin.release.path, dependencies, {
+    ...guard,
+    allowPreviousRelease: true,
+    preserveDatabaseOnFailure: true,
+    requiredPinnedReleaseRevision: pin.release.revision,
+  });
+}
+
+
+function configuredSourceRevision(sourceRoot: string): string {
+  const env = {
+    ...runtimeAuthorityFreeEnvironment(process.env),
+    PATH: recoveryCommandPath(),
+  };
+  // ReleaseSession source authority is the exact committed Git object selected
+  // internally by Recovery. The configured checkout is only an object/dependency
+  // provider: concurrent working-tree edits are intentionally non-authoritative
+  // and are excluded by the detached immutable source snapshot used below.
+  const head = spawnSync('git', ['-C', sourceRoot, 'rev-parse', '--verify', 'HEAD^{commit}'], {
+    encoding: 'utf8',
+    env,
+    timeout: 10_000,
+  });
+  const revision = (head.stdout ?? '').trim();
+  if (head.status !== 0 || !/^[a-f0-9]{40}$/i.test(revision)) {
+    throw new Error('RELEASE_SESSION_SOURCE_REVISION_UNAVAILABLE');
+  }
+  return revision;
+}
+
+export interface ConfiguredRuntimeReleaseSourceState {
+  configured: boolean;
+  sourceRevision?: string;
+  activeSourceCommit?: string;
+  activeReleaseId?: string;
+}
+
+/**
+ * Read the two immutable identities used only to decide whether automatic
+ * release reconciliation is warranted. This does not create or advance a
+ * ReleaseSession and therefore never becomes release intent authority.
+ */
+export function configuredRuntimeReleaseSourceState(config: RecoveryConfig): ConfiguredRuntimeReleaseSourceState {
+  const sourceRoot = config.primaryRuntimeSourceRoot?.trim();
+  if (!sourceRoot) return { configured: false };
+  const authority = readRuntimeReleaseAuthority(config.controllerHome);
+  if (!authority) throw new Error('RELEASE_AUTOMATION_ACTIVE_RELEASE_AUTHORITY_UNKNOWN');
+  const manifest = loadRuntimeReleaseManifest(authority.active.manifestPath, config.controllerHome);
+  return {
+    configured: true,
+    sourceRevision: configuredSourceRevision(sourceRoot),
+    activeSourceCommit: manifest.sourceCommit?.trim() || undefined,
+    activeReleaseId: authority.active.releaseId,
+  };
+}
+
+async function allocateCandidateLoopbackPort(stablePort: number): Promise<number> {
+  for (let attempt = 0; attempt < 8; attempt += 1) {
+    const port = await new Promise<number>((resolvePort, rejectPort) => {
+      const server = createNetServer();
+      server.unref();
+      server.once('error', rejectPort);
+      server.listen({ host: '127.0.0.1', port: 0, exclusive: true }, () => {
+        const address = server.address();
+        const selected = address && typeof address === 'object' ? address.port : 0;
+        server.close((error) => error ? rejectPort(error) : resolvePort(selected));
+      });
+    });
+    if (port > 0 && port !== stablePort) return port;
+  }
+  throw new Error('RELEASE_SESSION_CANDIDATE_PORT_UNAVAILABLE');
+}
+
+function stableReleaseSessionIdentity(config: RecoveryConfig): ReleaseSessionStableRelease {
+  const authority = releaseAuthority(config);
+  if (!authority) throw new Error('RELEASE_SESSION_STABLE_RELEASE_AUTHORITY_REQUIRED');
+  return {
+    authorityRevision: authority.revision,
+    releaseId: authority.active.releaseId,
+    artifactIdentity: authority.active.artifactIdentity,
+    manifestSha256: authority.active.manifestSha256,
+    workerProtocolVersion: authority.active.workerProtocolVersion,
+    releaseFencingTokenSha256: createHash('sha256').update(authority.fencingToken).digest('hex'),
+  };
+}
+
+function sameStableReleaseSessionIdentity(left: ReleaseSessionStableRelease, right: ReleaseSessionStableRelease): boolean {
+  return left.authorityRevision === right.authorityRevision
+    && left.releaseId === right.releaseId
+    && left.artifactIdentity === right.artifactIdentity
+    && left.manifestSha256 === right.manifestSha256
+    && left.workerProtocolVersion === right.workerProtocolVersion
+    && left.releaseFencingTokenSha256 === right.releaseFencingTokenSha256;
+}
+
+function assertStableReleaseSessionIdentityCurrent(config: RecoveryConfig, expected: ReleaseSessionStableRelease): void {
+  const actual = stableReleaseSessionIdentity(config);
+  if (
+    actual.authorityRevision !== expected.authorityRevision
+    || actual.releaseId !== expected.releaseId
+    || actual.artifactIdentity !== expected.artifactIdentity
+    || actual.manifestSha256 !== expected.manifestSha256
+    || actual.workerProtocolVersion !== expected.workerProtocolVersion
+    || actual.releaseFencingTokenSha256 !== expected.releaseFencingTokenSha256
+  ) throw new Error('RELEASE_SESSION_STABLE_AUTHORITY_CHANGED');
+}
+
+function candidateControllerHomeForSession(config: RecoveryConfig, sessionId: string): string {
+  return join(dirname(resolve(config.controllerHome)), 'candidate-runtime-lanes', sessionId);
+}
+
+export async function prepareConfiguredRuntimeReleaseSession(
+  config: RecoveryConfig,
+  dependencies: Pick<ConfiguredRuntimeActivationDependencies, 'stage'> = {},
+  requestId?: string,
+): Promise<ConfiguredRuntimeActivationResult> {
+  const sourceRoot = config.primaryRuntimeSourceRoot?.trim();
+  if (!sourceRoot) return { ok: false, attempted: false, noOp: true, detail: 'primary Runtime source root is not configured in standalone Recovery' };
+  const sourceRepositoryId = config.primaryRuntimeSourceRepositoryId?.trim();
+  if (!sourceRepositoryId) return { ok: false, attempted: false, noOp: true, detail: 'primary Runtime source repository id is not configured in standalone Recovery' };
+
+  const verifiedStable = await verifyStableRuntime(config);
+  if (!verifiedStable.ok) {
+    return { ok: false, attempted: false, noOp: true, detail: 'RELEASE_SESSION_STABLE_RUNTIME_NOT_VERIFIED' };
+  }
+
+  const locked = await withLock(config, {
+    action: 'release_session_prepare',
+    ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
+  }, async () => {
+    const stable = readStableExecutionLane(config.controllerHome);
+    const stableRelease = stableReleaseSessionIdentity(config);
+    const sourceRevision = configuredSourceRevision(sourceRoot);
+
+    // ReleaseSession owns semantic progression. This Recovery lock serializes only
+    // physical preparation. Resume the exact source_frozen session after an
+    // interruption instead of inventing a second release authority.
+    const inventory = listCompleteReleaseSessions(config.controllerHome);
+    if (inventory.invalidSessionFiles.length > 0) {
+      return {
+        ok: false as const,
+        attempted: false,
+        noOp: true,
+        detail: `RELEASE_SESSION_INVENTORY_INCOMPLETE: invalid=${inventory.invalidSessionFiles.join(',') || 'none'}`,
+      };
+    }
+    await reconcileOrphanCandidateLanes(config, stable, inventory.sessions);
+    let resumableMatchingSession: ReleaseSession | undefined;
+    for (const existing of [...inventory.sessions].sort((left, right) => left.updatedAt.localeCompare(right.updatedAt))) {
+      // Candidate B becomes disposable once the semantic ReleaseSession says it
+      // is retired. Cleanup is deliberately retried here because process death
+      // can happen after the phase CAS but before the physical lane removal. The
+      // remover is session/path fenced and idempotent, so this reconciles leaked
+      // bytes without creating another retention authority.
+      if (releaseSessionCandidateIsRetired(existing)) cleanupRetiredCandidateLane(config, existing);
+      if (existing.phase === 'failed' || existing.phase === 'rolled_back' || existing.phase === 'known_good') continue;
+      const preparationReusablePhase = existing.phase === 'source_frozen'
+        || existing.phase === 'built'
+        || existing.phase === 'static_verified'
+        || existing.phase === 'candidate_booted'
+        || existing.phase === 'candidate_verified'
+        || existing.phase === 'cutover_eligible';
+      if (
+        preparationReusablePhase
+        && existing.sourceRevision === sourceRevision
+        && sameStableReleaseSessionIdentity(existing.stableRelease, stableRelease)
+      ) {
+        if (resumableMatchingSession) {
+          return {
+            ok: false as const,
+            attempted: false,
+            noOp: true,
+            detail: `RELEASE_SESSION_MULTIPLE_ACTIVE: ${resumableMatchingSession.sessionId}:${resumableMatchingSession.phase},${existing.sessionId}:${existing.phase}`,
+          };
+        }
+        resumableMatchingSession = existing;
+        continue;
+      }
+      if (existing.phase === 'cutover_attempting' || existing.phase === 'cutover_committed') {
+        return {
+          ok: false as const,
+          attempted: false,
+          noOp: true,
+          detail: `RELEASE_SESSION_PREPARE_REQUIRES_RECONCILIATION: ${existing.sessionId}:${existing.phase}`,
+          releaseSession: existing,
+        };
+      }
+      if (existing.phase === 'soaking') {
+        const candidateIsCurrentStable = releaseSessionIsSoakingPredecessorOfStable(existing, stableRelease);
+        if (candidateIsCurrentStable && existing.sourceRevision === sourceRevision) {
+          return {
+            ok: false as const,
+            attempted: false,
+            noOp: true,
+            detail: `RELEASE_SESSION_PREPARE_REQUIRES_SOAK_RESOLUTION: ${existing.sessionId}`,
+            releaseSession: existing,
+          };
+        }
+        if (candidateIsCurrentStable) {
+          // A newer source is allowed to prepare against the exact release that
+          // this predecessor already cut over. The predecessor remains soaking
+          // so its rollback authority survives until the successor commits.
+          continue;
+        }
+        if (releaseSessionIsSoakingSupersededByStableAuthority(existing, stableRelease)) {
+          const superseded = advanceReleaseSession({
+            controllerHome: config.controllerHome,
+            sessionId: existing.sessionId,
+            expectedRevision: existing.revision,
+            phase: 'failed',
+            receipts: [{
+              id: 'soak_superseded_by_runtime_authority',
+              kind: 'soak',
+              summary: `Soaking release ${existing.candidateRelease?.releaseId ?? 'unknown'} was superseded by active Runtime authority ${stableRelease.releaseId}@${stableRelease.authorityRevision}`.slice(0, 500),
+            }],
+          });
+          audit(config, 'release_session_soak_superseded_by_runtime_authority', {
+            sessionId: existing.sessionId,
+            priorCutoverAuthorityRevision: existing.transaction?.cutoverAuthorityRevision,
+            activeAuthorityRevision: stableRelease.authorityRevision,
+            activeReleaseId: stableRelease.releaseId,
+          });
+          cleanupRetiredCandidateLane(config, superseded);
+          continue;
+        }
+        return {
+          ok: false as const,
+          attempted: false,
+          noOp: true,
+          detail: `RELEASE_SESSION_SOAK_RUNTIME_IDENTITY_MISMATCH: ${existing.sessionId}`,
+          releaseSession: existing,
+        };
+      }
+      const superseded = await cancelReleaseSessionUnderLock(
+        config,
+        existing,
+        'superseded by a newer ReleaseSession source freeze',
+      );
+      if (!superseded.ok) return superseded;
+    }
+
+    if (resumableMatchingSession && resumableMatchingSession.phase !== 'source_frozen') {
+      return {
+        ok: true as const,
+        attempted: false,
+        noOp: true,
+        detail: `matching ReleaseSession ${resumableMatchingSession.sessionId} already advanced to ${resumableMatchingSession.phase}; preparation is idempotent and must not supersede it`,
+        releaseSession: resumableMatchingSession,
+      };
+    }
+
+    // Reconcile and reclaim only bytes that no current rollback authority needs.
+    // This is one bounded lifecycle attempt, not a second GC owner, and it
+    // retains fail-closed behavior whenever an authority cannot be proven.
+    reconcileKnownGoodRecoveryRetention(config);
+    const releaseRetention = cleanupControllerReleaseHistory(config.controllerHome, {
+      graceMs: 0,
+      stagingGraceMs: 0,
+      maxRemovals: 16,
+    });
+    if (releaseRetention.errors.length > 0) {
+      throw new Error(`RELEASE_SESSION_RETENTION_RECONCILIATION_FAILED: ${releaseRetention.errors.slice(0, 3).join('; ')}`);
+    }
+
+    // Capacity is operation-specific: the candidate is a measured copy of the
+    // current immutable Runtime tree plus a consistent SQLite snapshot. The
+    // global warning threshold is observability, not rollback reserve; existing
+    // active/previous authorities are already allocated and protected above.
+    const candidateRoot = join(dirname(resolve(config.controllerHome)), 'candidate-runtime-lanes');
+    const storageEstimate = estimateReleaseSessionCandidateBytes(config, releaseAuthority(config)!.active.manifestPath);
+    assertStorageHeadroom(candidateRoot, {
+      operation: 'release_session_prepare',
+      requiredBytes: storageEstimate.requiredBytes,
+      reserveBytes: storageEstimate.reserveBytes,
+    });
+
+    let session: ReleaseSession;
+    let candidateLane: ReturnType<typeof createCandidateExecutionLane>['candidate'];
+    if (resumableMatchingSession) {
+      session = resumableMatchingSession;
+      candidateLane = session.candidate;
+    } else {
+      const nextSessionId = `release-${Date.now()}-${randomUUID().replaceAll('-', '').slice(0, 16)}`;
+      const candidatePort = await allocateCandidateLoopbackPort(stable.port);
+      candidateLane = createCandidateExecutionLane({
+        stableControllerHome: stable.controllerHome,
+        candidateControllerHome: candidateControllerHomeForSession(config, nextSessionId),
+        candidatePort,
+        sessionId: nextSessionId,
+      }).candidate;
+      session = createReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId: nextSessionId,
+        stable,
+        stableRelease,
+        candidate: candidateLane,
+        sourceRevision,
+      });
+    }
+    const sessionId = session.sessionId;
+
+    try {
+      assertStableReleaseSessionIdentityCurrent(config, stableRelease);
+      const staged = withRuntimeReleaseSourceSnapshot({ sourceRoot, sourceRevision }, frozenSourceRoot =>
+        (dependencies.stage ?? stageRuntimeReleaseFromCandidateSource)({
+          controllerHome: candidateLane.controllerHome,
+          sourceRoot: frozenSourceRoot,
+          dependencyRoot: sourceRoot,
+          sourceRepositoryId,
+        }));
+      assertRuntimeReleaseFiles(staged);
+      if (staged.sourceCommit !== sourceRevision) throw new Error('RELEASE_SESSION_SOURCE_CHANGED_DURING_BUILD');
+      const candidateRelease: ReleaseSessionCandidateRelease = {
+        releaseId: staged.releaseId,
+        manifestPath: staged.manifestPath,
+        artifactIdentity: staged.artifactIdentity,
+        manifestSha256: staged.manifestSha256,
+        treeSha256: runtimeReleaseTreeSha256(staged.releasePath),
+        sourceCommit: staged.sourceCommit,
+        ...(staged.sourceRepositoryId ? { sourceRepositoryId: staged.sourceRepositoryId } : {}),
+      };
+      assertStableReleaseSessionIdentityCurrent(config, stableRelease);
+      session = advanceReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId,
+        expectedRevision: session.revision,
+        phase: 'built',
+        candidateRelease,
+        receipts: [{
+          id: 'build',
+          kind: 'build',
+          summary: `portable candidate ${staged.releaseId} built under isolated Candidate B; Stable A unchanged`,
+        }],
+      });
+      audit(config, 'release_session_candidate_built', {
+        sessionId,
+        sourceRevision,
+        stableReleaseId: stableRelease.releaseId,
+        stableAuthorityRevision: stableRelease.authorityRevision,
+        candidateControllerHome: candidateLane.controllerHome,
+        candidatePort: candidateLane.port,
+        candidateReleaseId: staged.releaseId,
+        candidateTreeSha256: candidateRelease.treeSha256,
+      });
+      return {
+        ok: true as const,
+        attempted: true,
+        detail: 'configured Runtime source was built into an isolated Candidate B ReleaseSession; Stable A was not stopped or activated',
+        staged,
+        releaseSession: session,
+      };
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      try {
+        session = advanceReleaseSession({
+          controllerHome: config.controllerHome,
+          sessionId,
+          expectedRevision: session.revision,
+          phase: 'failed',
+          receipts: [{ id: 'build_failed', kind: 'build', summary: detail.slice(0, 500) }],
+        });
+      } catch { /* Preserve the original build failure. */ }
+      cleanupRetiredCandidateLane(config, session);
+      audit(config, 'release_session_candidate_build_failed', { sessionId, sourceRevision, detail });
+      return { ok: false as const, attempted: true, detail, releaseSession: session };
+    }
+  });
+
+  if (!locked.acquired) {
+    return { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner) };
+  }
+  return locked.value;
+}
+
+
+const RELEASE_SESSION_STATIC_GATES = [
+  { id: 'type', args: ['run', 'check:type'], timeoutMs: 10 * 60_000 },
+  { id: 'runtime_architecture', args: ['run', 'check:runtime-architecture'], timeoutMs: 5 * 60_000 },
+  { id: 'architecture_sync', args: ['run', 'check:architecture-sync'], timeoutMs: 5 * 60_000 },
+  { id: 'bootstrap', args: ['run', 'check:bootstrap-files'], timeoutMs: 5 * 60_000 },
+] as const;
+
+export async function verifyConfiguredRuntimeReleaseSessionStaticGates(
+  config: RecoveryConfig,
+  sessionId: string,
+  requestId?: string,
+): Promise<ConfiguredRuntimeActivationResult> {
+  const sourceRoot = config.primaryRuntimeSourceRoot?.trim();
+  if (!sourceRoot) return { ok: false, attempted: false, noOp: true, detail: 'primary Runtime source root is not configured in standalone Recovery' };
+  const locked = await withLock(config, {
+    action: 'release_session_static_verify',
+    ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
+  }, async () => {
+    let session = readReleaseSession(config.controllerHome, sessionId);
+    if (!session) return { ok: false as const, attempted: false, noOp: true, detail: 'RELEASE_SESSION_MISSING' };
+    if (session.phase !== 'built') {
+      return { ok: false as const, attempted: false, noOp: true, detail: `RELEASE_SESSION_STATIC_VERIFY_REQUIRES_BUILT: ${session.phase}`, releaseSession: session };
+    }
+    const candidate = session.candidateRelease;
+    if (!candidate) return { ok: false as const, attempted: false, noOp: true, detail: 'RELEASE_SESSION_CANDIDATE_RELEASE_REQUIRED', releaseSession: session };
+    const frozenSourceRevision = session.sourceRevision;
+    const stableRelease = session.stableRelease;
+    try {
+      assertStableReleaseSessionIdentityCurrent(config, stableRelease);
+      const manifest = loadRuntimeReleaseManifest(candidate.manifestPath, session.candidate.controllerHome);
+      if (
+        manifest.deploymentScope !== 'portable'
+        || manifest.releaseId !== candidate.releaseId
+        || manifest.artifactIdentity !== candidate.artifactIdentity
+        || createHash('sha256').update(readFileSync(candidate.manifestPath)).digest('hex') !== candidate.manifestSha256
+        || runtimeReleaseTreeSha256(dirname(candidate.manifestPath)) !== candidate.treeSha256
+      ) throw new Error('RELEASE_SESSION_CANDIDATE_IDENTITY_MISMATCH');
+
+      const receipts = withRuntimeReleaseSourceSnapshot({
+        sourceRoot,
+        sourceRevision: frozenSourceRevision,
+      }, frozenSourceRoot => {
+        const gateReceipts: Array<{ id: string; kind: 'static_gate'; summary: string }> = [];
+        for (const gate of RELEASE_SESSION_STATIC_GATES) {
+          assertStableReleaseSessionIdentityCurrent(config, stableRelease);
+          const startedAt = Date.now();
+          const bunExecutable = resolveBunExecutable();
+          const boundedRunner = join(frozenSourceRoot, 'scripts', 'run-bounded-command.mjs');
+          const result = spawnSync(bunExecutable, [
+            boundedRunner,
+            '--timeout-ms', String(gate.timeoutMs),
+            '--',
+            bunExecutable,
+            ...gate.args,
+          ], {
+            cwd: frozenSourceRoot,
+            env: { ...runtimeAuthorityFreeEnvironment(process.env), PATH: recoveryCommandPath() },
+            encoding: 'utf8',
+            // The inner bounded runner owns the command process group and gets a
+            // brief escalation window to terminate descendants before this
+            // outer Recovery watchdog is allowed to intervene.
+            timeout: gate.timeoutMs + 15_000,
+            maxBuffer: 8 * 1024 * 1024,
+          });
+          const durationMs = Date.now() - startedAt;
+          if (result.error || result.status !== 0) {
+            const detail = result.error instanceof Error
+              ? result.error.message
+              : (result.stderr || result.stdout || `exit ${result.status ?? 'unknown'}`).trim().slice(-2000);
+            throw new Error(`RELEASE_SESSION_STATIC_GATE_FAILED:${gate.id}: ${detail}`);
+          }
+          gateReceipts.push({
+            id: gate.id,
+            kind: 'static_gate',
+            summary: `${gate.id} passed on frozen source ${frozenSourceRevision} in ${durationMs}ms`,
+          });
+        }
+        return gateReceipts;
+      });
+      assertStableReleaseSessionIdentityCurrent(config, session.stableRelease);
+      session = advanceReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId,
+        expectedRevision: session.revision,
+        phase: 'static_verified',
+        receipts,
+      });
+      audit(config, 'release_session_static_verified', {
+        sessionId,
+        sourceRevision: session.sourceRevision,
+        candidateReleaseId: candidate.releaseId,
+        gates: RELEASE_SESSION_STATIC_GATES.map((gate) => gate.id),
+      });
+      return {
+        ok: true as const,
+        attempted: true,
+        detail: 'ReleaseSession static gates passed on the frozen source revision; Stable A remained unchanged',
+        releaseSession: session,
+      };
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      try {
+        session = advanceReleaseSession({
+          controllerHome: config.controllerHome,
+          sessionId,
+          expectedRevision: session.revision,
+          phase: 'failed',
+          receipts: [{ id: 'static_failed', kind: 'static_gate', summary: detail.slice(0, 500) }],
+        });
+      } catch { /* preserve the original static verification failure */ }
+      cleanupRetiredCandidateLane(config, session);
+      audit(config, 'release_session_static_failed', { sessionId, detail });
+      return { ok: false as const, attempted: true, detail, releaseSession: session };
+    }
+  });
+  if (!locked.acquired) return { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner) };
+  return locked.value;
+}
+
+
+const RELEASE_SESSION_CANDIDATE_VERIFY_TIMEOUT_MS = 60_000;
+
+function candidateRecoveryConfig(session: ReleaseSession): RecoveryConfig {
+  return {
+    schemaVersion: 1,
+    controllerHome: session.candidate.controllerHome,
+    installProfile: 'manual',
+    primaryRuntimeService: {
+      ...defaultPrimaryRuntimeServiceConfig(),
+      postRestartVerifyTimeoutMs: RELEASE_SESSION_CANDIDATE_VERIFY_TIMEOUT_MS,
+    },
+    mainMcpTokenFile: session.candidate.authTokenFile,
+    readOnlyTool: {
+      name: STABLE_RECOVERY_READ_ONLY_TOOL.name,
+      arguments: { ...STABLE_RECOVERY_READ_ONLY_TOOL.arguments },
+    },
+  };
+}
+
+async function installReleaseSessionCandidateService(
+  session: ReleaseSession,
+  runCommand: CommandRunner = command,
+): Promise<void> {
+  const candidateRelease = session.candidateRelease;
+  if (!candidateRelease) throw new Error('RELEASE_SESSION_CANDIDATE_RELEASE_REQUIRED');
+  const home = session.candidate.controllerHome;
+  const serviceConfig = readForgeRuntimeServiceConfig(forgeRuntimeServicePaths(home).configPath);
+  if (
+    resolve(serviceConfig.controllerHome) !== resolve(home)
+    || serviceConfig.port !== session.candidate.port
+    || resolve(serviceConfig.authTokenFile) !== resolve(session.candidate.authTokenFile)
+  ) throw new Error('RELEASE_SESSION_CANDIDATE_SERVICE_CONTRACT_MISMATCH');
+
+  const operationId = `release-session-candidate-${session.sessionId}`;
+  const authority = publishRuntimeRelease(home, candidateRelease.manifestPath, operationId);
+  if (
+    authority.active.releaseId !== candidateRelease.releaseId
+    || authority.active.artifactIdentity !== candidateRelease.artifactIdentity
+    || authority.active.manifestSha256 !== candidateRelease.manifestSha256
+  ) throw new Error('RELEASE_SESSION_CANDIDATE_AUTHORITY_MISMATCH');
+  syncForgeRuntimeActiveEntrypoint(home);
+
+  if (process.platform === 'darwin') {
+    await installForgeRuntimeService({
+      config: serviceConfig,
+      // Ignored in release mode; a non-empty bounded path keeps bootstrap fallback explicit.
+      runnerPath: candidateRelease.manifestPath,
+    });
+    return;
+  }
+  if (process.platform === 'linux') {
+    const env = runtimeAuthorityFreeEnvironment(process.env);
+    writePackageRuntimeSystemdUserService(home, env);
+    for (const argv of systemdRuntimeInstallCommands(forgeRuntimeServicePaths(home).label)) {
+      const [executable, ...args] = argv;
+      if (!executable) continue;
+      const result = await runCommand(executable, args, 20_000);
+      if (!result.ok) throw new Error(`RELEASE_SESSION_CANDIDATE_SYSTEMD_INSTALL_FAILED: ${result.stderr || result.stdout || executable}`);
+    }
+    return;
+  }
+  throw new Error(`RELEASE_SESSION_CANDIDATE_SERVICE_PLATFORM_UNSUPPORTED: ${process.platform}`);
+}
+
+interface ReleaseSessionCandidateRetirement {
+  ok: boolean;
+  detail: string;
+}
+
+function cleanupRetiredCandidateLane(config: RecoveryConfig, session: ReleaseSession): ReleaseSessionCandidateRetirement {
+  try {
+    const removed = removeRetiredCandidateExecutionLane(session.stable, session.candidate);
+    if (removed) {
+      audit(config, 'release_session_candidate_lane_cleaned', {
+        sessionId: session.sessionId,
+        candidateControllerHome: session.candidate.controllerHome,
+        phase: session.phase,
+      });
+    }
+    return {
+      ok: true,
+      detail: removed
+        ? 'Candidate B Controller Home was removed after terminal ReleaseSession cleanup'
+        : 'Candidate B Controller Home was already absent after terminal ReleaseSession cleanup',
+    };
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    audit(config, 'release_session_candidate_lane_cleanup_failed', {
+      sessionId: session.sessionId,
+      candidateControllerHome: session.candidate.controllerHome,
+      phase: session.phase,
+      detail,
+    });
+    return { ok: false, detail };
+  }
+}
+
+async function stopCandidateServiceAtHome(
+  home: string,
+  runCommand: CommandRunner = command,
+): Promise<ReleaseSessionCandidateRetirement> {
+  try {
+    if (process.platform === 'darwin') {
+      try {
+        await uninstallForgeRuntimeService(home);
+      } catch (error) {
+        const uid = await currentUid();
+        if (uid === undefined) {
+          return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+        }
+        const paths = forgeRuntimeServicePaths(home);
+        const loaded = await runCommand('launchctl', ['print', `gui/${uid}/${paths.label}`], 5_000);
+        if (loaded.ok) {
+          return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+        }
+        // An already-absent launchd job is an idempotent retirement. Remove only
+        // its stale installed declaration, then verify the Runtime itself below.
+        rmSync(paths.installedPlistPath, { force: true });
+      }
+    } else if (process.platform === 'linux') {
+      const label = forgeRuntimeServicePaths(home).label;
+      const unitName = systemdUserUnitName(label);
+      const stopped = await runCommand('systemctl', ['--user', 'disable', '--now', unitName], 20_000);
+      const stoppedDetail = `${stopped.stderr}\n${stopped.stdout}`;
+      if (!stopped.ok && !/not loaded|not found|does not exist|no such file/i.test(stoppedDetail)) {
+        return { ok: false, detail: `RELEASE_SESSION_CANDIDATE_SYSTEMD_STOP_FAILED: ${stoppedDetail.trim() || stopped.status}` };
+      }
+      rmSync(systemdUserUnitPath(unitName), { force: true });
+      const reloaded = await runCommand('systemctl', ['--user', 'daemon-reload'], 20_000);
+      if (!reloaded.ok) {
+        return { ok: false, detail: `RELEASE_SESSION_CANDIDATE_SYSTEMD_RELOAD_FAILED: ${reloaded.stderr || reloaded.stdout || reloaded.status}` };
+      }
+    } else {
+      return { ok: false, detail: `RELEASE_SESSION_CANDIDATE_SERVICE_PLATFORM_UNSUPPORTED: ${process.platform}` };
+    }
+  } catch (error) {
+    return { ok: false, detail: error instanceof Error ? error.message : String(error) };
+  }
+
+  const observation = observeRuntimeStatus(home);
+  if (observation.running) {
+    return { ok: false, detail: 'RELEASE_SESSION_CANDIDATE_STILL_RUNNING_AFTER_RETIREMENT' };
+  }
+  return { ok: true, detail: 'Candidate B persistent service is absent and its Runtime process is not running' };
+}
+
+async function stopReleaseSessionCandidateService(
+  session: ReleaseSession,
+  runCommand: CommandRunner = command,
+): Promise<ReleaseSessionCandidateRetirement> {
+  return stopCandidateServiceAtHome(session.candidate.controllerHome, runCommand);
+}
+
+async function reconcileOrphanCandidateLanes(
+  config: RecoveryConfig,
+  stable: ReturnType<typeof readStableExecutionLane>,
+  sessions: ReleaseSession[],
+): Promise<void> {
+  const candidateRoot = resolve(dirname(resolve(config.controllerHome)), 'candidate-runtime-lanes');
+  if (!existsSync(candidateRoot)) return;
+  const knownHomes = new Set(sessions.map((session) => resolve(session.candidate.controllerHome)));
+  const entries = readdirSync(candidateRoot, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .sort((left, right) => left.name.localeCompare(right.name));
+  if (entries.length > 512) throw new Error(`RELEASE_SESSION_CANDIDATE_LANE_INVENTORY_INCOMPLETE: ${entries.length}`);
+
+  for (const entry of entries) {
+    const candidateHome = resolve(candidateRoot, entry.name);
+    if (knownHomes.has(candidateHome)) continue;
+    try {
+      // Reuse ReleaseSession's own id parser as the identity fence. A directory
+      // whose name is not a valid session id is visible debt, not delete authority.
+      if (readReleaseSession(config.controllerHome, entry.name)) continue;
+    } catch (error) {
+      audit(config, 'release_session_orphan_candidate_identity_invalid', {
+        candidateControllerHome: candidateHome,
+        detail: error instanceof Error ? error.message : String(error),
+      });
+      continue;
+    }
+
+    let candidateConfig;
+    try {
+      candidateConfig = readForgeRuntimeServiceConfig(forgeRuntimeServicePaths(candidateHome).configPath, { missingRepositoryRoot: 'omit' });
+    } catch (error) {
+      audit(config, 'release_session_orphan_candidate_service_contract_unproven', {
+        sessionId: entry.name,
+        candidateControllerHome: candidateHome,
+        detail: error instanceof Error ? error.message : String(error),
+      });
+      continue;
+    }
+    if (resolve(candidateConfig.controllerHome) !== candidateHome || candidateConfig.port === stable.port) {
+      audit(config, 'release_session_orphan_candidate_service_contract_mismatch', {
+        sessionId: entry.name,
+        candidateControllerHome: candidateHome,
+        configuredControllerHome: candidateConfig.controllerHome,
+        configuredPort: candidateConfig.port,
+        stablePort: stable.port,
+      });
+      continue;
+    }
+
+    let running = true;
+    try {
+      running = observeRuntimeStatus(candidateHome).running;
+    } catch (error) {
+      audit(config, 'release_session_orphan_candidate_owner_unknown', {
+        sessionId: entry.name,
+        candidateControllerHome: candidateHome,
+        detail: error instanceof Error ? error.message : String(error),
+      });
+      continue;
+    }
+    if (running) {
+      audit(config, 'release_session_orphan_candidate_active_owner', { sessionId: entry.name, candidateControllerHome: candidateHome });
+      continue;
+    }
+
+    const retirement = await stopCandidateServiceAtHome(candidateHome);
+    if (!retirement.ok) {
+      audit(config, 'release_session_orphan_candidate_service_retirement_failed', {
+        sessionId: entry.name,
+        candidateControllerHome: candidateHome,
+        detail: retirement.detail,
+      });
+      continue;
+    }
+    try {
+      const removed = removeRetiredCandidateExecutionLane(stable, { controllerHome: candidateHome, sessionId: entry.name });
+      if (removed) {
+        audit(config, 'release_session_orphan_candidate_lane_cleaned', { sessionId: entry.name, candidateControllerHome: candidateHome });
+      }
+    } catch (error) {
+      audit(config, 'release_session_orphan_candidate_lane_cleanup_failed', {
+        sessionId: entry.name,
+        candidateControllerHome: candidateHome,
+        detail: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+}
+
+function candidateCanaryReceipts(
+  session: ReleaseSession,
+  verified: VerifyResult,
+): Array<{ id: string; kind: 'candidate_canary'; summary: string }> {
+  const observation = observeRuntimeStatus(session.candidate.controllerHome);
+  const diagnostics = observation.snapshot?.readiness.diagnostics;
+  const mcpProbeNames = ['mcp_initialize', 'mcp_initialized_notification', 'mcp_tools_list', 'mcp_read_only_call', 'mcp_session_close'];
+  const failedMcp = mcpProbeNames.filter((name) => verified.probes[name]?.ok !== true);
+  if (failedMcp.length > 0) throw new Error(`RELEASE_SESSION_CANDIDATE_MCP_CANARY_FAILED: ${failedMcp.join(',')}`);
+  if (diagnostics?.scheduler.outcome !== 'pass') throw new Error('RELEASE_SESSION_CANDIDATE_SCHEDULER_CANARY_FAILED');
+  if (diagnostics?.database.outcome !== 'pass' || diagnostics?.releaseCoherence.outcome !== 'pass' || diagnostics?.mcpEndToEnd.outcome !== 'pass') {
+    throw new Error('RELEASE_SESSION_CANDIDATE_RUNTIME_DIAGNOSTICS_FAILED');
+  }
+  const supervisorSocket = workflowSupervisorSocketPath(resolveWorkflowSupervisorForgeHome(session.candidate.controllerHome));
+  if (!existsSync(supervisorSocket)) throw new Error('RELEASE_SESSION_CANDIDATE_SUPERVISOR_CANARY_FAILED');
+  return [
+    { id: 'recovery', kind: 'candidate_canary', summary: 'Candidate B stopped and restarted through Recovery service lifecycle and returned whole-Runtime healthy' },
+    { id: 'mcp', kind: 'candidate_canary', summary: 'Candidate B MCP initialize/tools-list/read-only-call/session-close passed using the Candidate credential' },
+    { id: 'scheduler', kind: 'candidate_canary', summary: 'Candidate B scheduler readiness diagnostic passed after recovery restart' },
+    { id: 'supervisor', kind: 'candidate_canary', summary: `Candidate B Workflow Supervisor socket is live at ${supervisorSocket}` },
+    { id: 'controller', kind: 'candidate_canary', summary: 'Candidate B controller read-only facade completed through MCP after restart' },
+  ];
+}
+
+export async function bootAndVerifyConfiguredRuntimeReleaseSessionCandidate(
+  config: RecoveryConfig,
+  sessionId: string,
+  requestId?: string,
+): Promise<ConfiguredRuntimeActivationResult> {
+  const locked = await withLock(config, {
+    action: 'release_session_candidate_boot',
+    ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
+  }, async () => {
+    let session = readReleaseSession(config.controllerHome, sessionId);
+    if (!session) return { ok: false as const, attempted: false, noOp: true, detail: 'RELEASE_SESSION_MISSING' };
+    if (session.phase === 'candidate_booted') {
+      const retirement = await stopReleaseSessionCandidateService(session);
+      if (!retirement.ok) {
+        return {
+          ok: false as const,
+          attempted: true,
+          detail: `Candidate B boot/restart canary was interrupted and retirement failed: ${retirement.detail}`,
+          releaseSession: session,
+        };
+      }
+      session = advanceReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId,
+        expectedRevision: session.revision,
+        phase: 'failed',
+        receipts: [{
+          id: 'candidate_failed',
+          kind: 'candidate_canary',
+          summary: 'Candidate B boot/restart canary was interrupted; Candidate B was retired before terminalizing the ReleaseSession',
+        }],
+      });
+      cleanupRetiredCandidateLane(config, session);
+      return {
+        ok: false as const,
+        attempted: true,
+        detail: 'Candidate B boot/restart canary was interrupted; Candidate B is retired and the ReleaseSession is terminal failed',
+        releaseSession: session,
+      };
+    }
+    if (session.phase !== 'static_verified') {
+      return { ok: false as const, attempted: false, noOp: true, detail: `RELEASE_SESSION_CANDIDATE_BOOT_REQUIRES_STATIC_VERIFIED: ${session.phase}`, releaseSession: session };
+    }
+    const candidateRelease = session.candidateRelease;
+    if (!candidateRelease) return { ok: false as const, attempted: false, noOp: true, detail: 'RELEASE_SESSION_CANDIDATE_RELEASE_REQUIRED', releaseSession: session };
+    const runCommand = command;
+    const candidateConfig = candidateRecoveryConfig(session);
+    try {
+      assertStableReleaseSessionIdentityCurrent(config, session.stableRelease);
+      if (runtimeReleaseTreeSha256(dirname(candidateRelease.manifestPath)) !== candidateRelease.treeSha256) {
+        throw new Error('RELEASE_SESSION_CANDIDATE_TREE_CHANGED');
+      }
+      await installReleaseSessionCandidateService(session, runCommand);
+
+      let initialVerify = await verifyPrimaryRuntimeAfterStart({
+        config: candidateConfig,
+        timeoutMs: RELEASE_SESSION_CANDIDATE_VERIFY_TIMEOUT_MS,
+        now: Date.now,
+        wait: sleep,
+        verifyLocal: verifyLocalRuntime,
+        observeLocal: observePrimaryRuntimeActivationReadiness,
+      });
+      if (!initialVerify.ok) throw new Error(`RELEASE_SESSION_CANDIDATE_BOOT_UNVERIFIED: ${initialVerify.runtime.reasonCodes.join(',')}`);
+      assertStableReleaseSessionIdentityCurrent(config, session.stableRelease);
+      session = advanceReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId,
+        expectedRevision: session.revision,
+        phase: 'candidate_booted',
+        receipts: [{ id: 'candidate_boot', kind: 'candidate_canary', summary: 'Candidate B booted and passed initial whole-Runtime verification while Stable A remained healthy' }],
+      });
+
+      const platform = process.platform;
+      const uid = await currentUid();
+      const service = primaryRuntimeServiceOwner(candidateConfig, platform, uid);
+      if (!service) throw new Error('RELEASE_SESSION_CANDIDATE_SERVICE_OWNER_MISSING');
+      const stopped = await stopPrimaryRuntimeForReleaseTransition({
+        config: candidateConfig,
+        service,
+        now: Date.now,
+        wait: sleep,
+        runCommand,
+        runtimeRunning: (candidate) => observeRuntimeStatus(candidate.controllerHome).running,
+      });
+      if (!stopped.ok) throw new Error(`RELEASE_SESSION_CANDIDATE_RECOVERY_STOP_FAILED: ${stopped.detail}`);
+      const restarted = await restartPrimaryRuntime(candidateConfig);
+      if (!restarted.ok) throw new Error(`RELEASE_SESSION_CANDIDATE_RECOVERY_RESTART_FAILED: ${restarted.detail}`);
+      initialVerify = restarted.verify;
+      const receipts = candidateCanaryReceipts(session, initialVerify);
+      assertStableReleaseSessionIdentityCurrent(config, session.stableRelease);
+      session = advanceReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId,
+        expectedRevision: session.revision,
+        phase: 'candidate_verified',
+        receipts,
+      });
+      session = advanceReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId,
+        expectedRevision: session.revision,
+        phase: 'cutover_eligible',
+      });
+      audit(config, 'release_session_candidate_verified', {
+        sessionId,
+        candidateReleaseId: candidateRelease.releaseId,
+        candidateControllerHome: session.candidate.controllerHome,
+        candidatePort: session.candidate.port,
+        stableReleaseId: session.stableRelease.releaseId,
+      });
+      return {
+        ok: true as const,
+        attempted: true,
+        detail: 'Candidate B booted in isolation, survived a Recovery restart canary, passed MCP/Scheduler/Supervisor/Controller canaries, and is cutover-eligible; Stable A remains active',
+        releaseSession: session,
+      };
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      const retirement = await stopReleaseSessionCandidateService(session, runCommand);
+      const terminalDetail = retirement.ok
+        ? detail
+        : `${detail}; Candidate B retirement failed: ${retirement.detail}`;
+      try {
+        const latest = readReleaseSession(config.controllerHome, sessionId) ?? session;
+        session = latest;
+        if (retirement.ok && !['failed', 'rolled_back', 'known_good'].includes(latest.phase)) {
+          session = advanceReleaseSession({
+            controllerHome: config.controllerHome,
+            sessionId,
+            expectedRevision: latest.revision,
+            phase: 'failed',
+            receipts: [{ id: 'candidate_failed', kind: 'candidate_canary', summary: terminalDetail.slice(0, 500) }],
+          });
+        }
+        if (retirement.ok && ['failed', 'rolled_back'].includes(session.phase)) {
+          cleanupRetiredCandidateLane(config, session);
+        }
+      } catch { /* preserve original Candidate B failure */ }
+      audit(config, 'release_session_candidate_failed', {
+        sessionId,
+        detail,
+        candidateRetired: retirement.ok,
+        candidateRetirementDetail: retirement.detail,
+      });
+      return { ok: false as const, attempted: true, detail: terminalDetail, releaseSession: session };
+    }
+  });
+  if (!locked.acquired) return { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner) };
+  return locked.value;
+}
+
+
+function terminalizeSupersededSoakingPredecessor(config: RecoveryConfig, successor: ReleaseSession): ReleaseSession | undefined {
+  const inventory = listCompleteReleaseSessions(config.controllerHome);
+  if (inventory.invalidSessionFiles.length > 0) {
+    throw new Error(`RELEASE_SESSION_INVENTORY_INCOMPLETE: invalid=${inventory.invalidSessionFiles.join(',') || 'none'}`);
+  }
+  const predecessors = inventory.sessions.filter((existing) =>
+    existing.sessionId !== successor.sessionId
+    && existing.sourceRevision !== successor.sourceRevision
+    && releaseSessionIsSoakingPredecessorOfStable(existing, successor.stableRelease));
+  if (predecessors.length > 1) {
+    throw new Error(`RELEASE_SESSION_MULTIPLE_SOAKING_PREDECESSORS: ${predecessors.map((entry) => entry.sessionId).join(',')}`);
+  }
+  const predecessor = predecessors[0];
+  if (!predecessor) return undefined;
+  const terminal = advanceReleaseSession({
+    controllerHome: config.controllerHome,
+    sessionId: predecessor.sessionId,
+    expectedRevision: predecessor.revision,
+    phase: 'failed',
+    receipts: [{
+      id: `successor_cutover:${successor.sessionId}`,
+      kind: 'soak',
+      summary: `superseded without known-good promotion after successor ${successor.sessionId} committed a cutover from Stable A ${successor.stableRelease.releaseId}`,
+    }],
+  });
+  audit(config, 'release_session_soaking_predecessor_superseded', {
+    predecessorSessionId: predecessor.sessionId,
+    predecessorReleaseId: predecessor.candidateRelease?.releaseId,
+    successorSessionId: successor.sessionId,
+    successorReleaseId: successor.candidateRelease?.releaseId,
+  });
+  return terminal;
+}
+
+export async function cutoverConfiguredRuntimeReleaseSession(
+  config: RecoveryConfig,
+  sessionId: string,
+  requestId?: string,
+): Promise<ConfiguredRuntimeActivationResult> {
+  const locked = await withLock(config, {
+    action: 'release_session_cutover',
+    ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
+  }, async (releaseSessionLock) => {
+    const initialSession = readReleaseSession(config.controllerHome, sessionId);
+    if (!initialSession) return { ok: false as const, attempted: false, noOp: true, detail: 'RELEASE_SESSION_MISSING' };
+    let session: ReleaseSession = initialSession;
+    const candidateRelease = session.candidateRelease;
+    if (!candidateRelease) return { ok: false as const, attempted: false, noOp: true, detail: 'RELEASE_SESSION_CANDIDATE_RELEASE_REQUIRED', releaseSession: session };
+
+    const reconcileCutoverAttempt = async (
+      reason: string,
+      activation?: RuntimeReleaseActivationResult,
+    ): Promise<ConfiguredRuntimeActivationResult> => {
+      // Activation may have durably captured the ReleaseSession rollback
+      // transaction and advanced its CAS revision. Re-read the one semantic
+      // authority before any post-cutover phase transition.
+      session = readReleaseSession(config.controllerHome, sessionId) ?? session;
+      const retirement = await stopReleaseSessionCandidateService(session);
+      if (!retirement.ok) {
+        audit(config, 'release_session_candidate_retirement_failed', {
+          sessionId,
+          phase: session.phase,
+          candidateControllerHome: session.candidate.controllerHome,
+          detail: retirement.detail,
+          reconciliationReason: reason,
+        });
+        return {
+          ok: false as const,
+          attempted: true,
+          detail: `${reason}; Candidate B retirement failed: ${retirement.detail}`,
+          releaseSession: session,
+          ...(activation ? { activation } : {}),
+        };
+      }
+
+      const reconciliationTimeoutMs = Math.max(
+        1_000,
+        configuredPrimaryRuntimeService(config).postRestartVerifyTimeoutMs ?? 60_000,
+      );
+      const reconciliationDeadline = Date.now() + reconciliationTimeoutMs;
+      let stableNow = observeRuntimeStatus(config.controllerHome);
+      const stableIdentity = () => {
+        const liveRuntimeIdentityVerified = stableNow.running && stableNow.ready && !stableNow.stale;
+        return {
+          candidateIsStable: Boolean(
+            liveRuntimeIdentityVerified
+            && stableNow.snapshot?.releaseId === candidateRelease.releaseId
+            && stableNow.snapshot?.artifactIdentity === candidateRelease.artifactIdentity,
+          ),
+          originalStableRestored: Boolean(
+            liveRuntimeIdentityVerified
+            && stableNow.snapshot?.releaseId === session.stableRelease.releaseId
+            && stableNow.snapshot?.artifactIdentity === session.stableRelease.artifactIdentity,
+          ),
+        };
+      };
+      let observedIdentity = stableIdentity();
+      while (!observedIdentity.candidateIsStable && !observedIdentity.originalStableRestored && Date.now() < reconciliationDeadline) {
+        await sleep(Math.min(500, Math.max(1, reconciliationDeadline - Date.now())));
+        stableNow = observeRuntimeStatus(config.controllerHome);
+        observedIdentity = stableIdentity();
+      }
+      const { candidateIsStable, originalStableRestored } = observedIdentity;
+
+      if (candidateIsStable) {
+        if (session.phase === 'cutover_attempting') {
+          session = advanceReleaseSession({
+            controllerHome: config.controllerHome,
+            sessionId,
+            expectedRevision: session.revision,
+            phase: 'cutover_committed',
+            receipts: [{
+              id: 'cutover',
+              kind: 'cutover',
+              summary: `Stable A runs verified Candidate B release ${candidateRelease.releaseId}; Candidate B retired before cutover commit`,
+            }],
+          });
+        }
+        // Stable A now owns the successor and its transaction can roll back to
+        // the predecessor release. Only at this durable boundary may the older
+        // soaking session surrender its independent rollback/acceptance path.
+        terminalizeSupersededSoakingPredecessor(config, session);
+        session = advanceReleaseSession({
+          controllerHome: config.controllerHome,
+          sessionId,
+          expectedRevision: session.revision,
+          phase: 'soaking',
+          receipts: [{
+            id: 'soak_started',
+            kind: 'soak',
+            summary: `cutover reconciled at ${new Date().toISOString()}; Candidate B is retired and known-good promotion remains gated on later stable verification`,
+          }],
+        });
+        const cleanup = cleanupRetiredCandidateLane(config, session);
+        audit(config, 'release_session_cutover_reconciled_committed', {
+          sessionId,
+          releaseId: candidateRelease.releaseId,
+          candidateRetired: true,
+          reason,
+        });
+        return {
+          ok: true as const,
+          attempted: true,
+          detail: `ReleaseSession cutover reconciled to committed: Stable A runs the verified candidate artifact and Candidate B is retired${cleanup.ok ? '' : `; Candidate B cleanup failed: ${cleanup.detail}`}`,
+          releaseSession: session,
+          ...(activation ? { activation } : {}),
+        };
+      }
+
+      if (originalStableRestored) {
+        session = advanceReleaseSession({
+          controllerHome: config.controllerHome,
+          sessionId,
+          expectedRevision: session.revision,
+          phase: 'rolled_back',
+          receipts: [{
+            id: 'rollback',
+            kind: 'rollback',
+            summary: `cutover did not commit; exact Stable A ${session.stableRelease.releaseId} is active and verified, and Candidate B is retired`,
+          }],
+        });
+        const cleanup = cleanupRetiredCandidateLane(config, session);
+        audit(config, 'release_session_cutover_reconciled_rolled_back', {
+          sessionId,
+          restoredStableReleaseId: session.stableRelease.releaseId,
+          candidateRetired: true,
+          reason,
+        });
+        return {
+          ok: false as const,
+          attempted: true,
+          detail: `ReleaseSession cutover reconciled to rolled_back: exact Stable A is active and Candidate B is retired${cleanup.ok ? '' : `; Candidate B cleanup failed: ${cleanup.detail}`}`,
+          releaseSession: session,
+          ...(activation ? { activation } : {}),
+        };
+      }
+
+      session = advanceReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId,
+        expectedRevision: session.revision,
+        phase: 'failed',
+        receipts: [{
+          id: 'cutover_failed',
+          kind: 'cutover',
+          summary: `${reason}; Stable A outcome is not fully verified; Candidate B is retired`.slice(0, 500),
+        }],
+      });
+      const cleanup = cleanupRetiredCandidateLane(config, session);
+      audit(config, 'release_session_cutover_reconciled_failed', {
+        sessionId,
+        candidateReleaseId: candidateRelease.releaseId,
+        candidateRetired: true,
+        reason,
+        observedActiveReleaseId: stableNow.snapshot?.releaseId,
+      });
+      return {
+        ok: false as const,
+        attempted: true,
+        detail: `${reason}; Candidate B is retired but Stable A cutover/rollback outcome is not fully verified${cleanup.ok ? '' : `; Candidate B cleanup failed: ${cleanup.detail}`}`,
+        releaseSession: session,
+        ...(activation ? { activation } : {}),
+      };
+    };
+
+    if (session.phase === 'cutover_attempting' || session.phase === 'cutover_committed') {
+      return reconcileCutoverAttempt(`resuming ReleaseSession from ${session.phase} without a second activation attempt`);
+    }
+    if (session.phase !== 'cutover_eligible') {
+      return { ok: false as const, attempted: false, noOp: true, detail: `RELEASE_SESSION_CUTOVER_REQUIRES_ELIGIBLE: ${session.phase}`, releaseSession: session };
+    }
+
+    try {
+      assertStableReleaseSessionIdentityCurrent(config, session.stableRelease);
+      const stableBefore = await verifyLocalRuntimeForReleaseCutover(config);
+      if (!stableBefore.ok) {
+        const reasonCodes = stableBefore.runtime.reasonCodes.join(',') || 'unknown';
+        audit(config, 'release_session_cutover_precondition_deferred', {
+          sessionId,
+          detail: 'stable Runtime verification is temporarily unavailable before cutover',
+          reasonCodes,
+        });
+        return {
+          ok: false as const,
+          attempted: false,
+          noOp: true,
+          detail: `RELEASE_SESSION_STABLE_RUNTIME_VERIFICATION_DEFERRED: ${reasonCodes}`,
+          releaseSession: session,
+        };
+      }
+      if (
+        stableBefore.releases.active?.revision !== session.stableRelease.releaseId
+        || stableBefore.releases.active?.artifactIdentity !== session.stableRelease.artifactIdentity
+      ) throw new Error('RELEASE_SESSION_STABLE_RUNTIME_IDENTITY_CHANGED');
+
+      const candidateConfig = candidateRecoveryConfig(session);
+      const candidateBefore = await verifyLocalRuntimeForReleaseCutover(candidateConfig);
+      if (
+        !candidateBefore.ok
+        || candidateBefore.releases.active?.revision !== candidateRelease.releaseId
+        || candidateBefore.releases.active?.artifactIdentity !== candidateRelease.artifactIdentity
+      ) throw new Error('RELEASE_SESSION_CANDIDATE_NO_LONGER_VERIFIED');
+      if (runtimeReleaseTreeSha256(dirname(candidateRelease.manifestPath)) !== candidateRelease.treeSha256) {
+        throw new Error('RELEASE_SESSION_CANDIDATE_TREE_CHANGED');
+      }
+
+      const promoted = promotePortableRuntimeRelease({
+        sourceManifestPath: candidateRelease.manifestPath,
+        targetControllerHome: config.controllerHome,
+        expectedTreeSha256: candidateRelease.treeSha256,
+      });
+      if (
+        promoted.releaseId !== candidateRelease.releaseId
+        || promoted.artifactIdentity !== candidateRelease.artifactIdentity
+        || promoted.manifestSha256 !== candidateRelease.manifestSha256
+        || promoted.treeSha256 !== candidateRelease.treeSha256
+      ) throw new Error('RELEASE_SESSION_PROMOTION_IDENTITY_MISMATCH');
+
+      // Promotion writes only a new immutable release tree. Stable A must still
+      // be the exact frozen authority before we enter the one cutover attempt.
+      assertStableReleaseSessionIdentityCurrent(config, session.stableRelease);
+      const stableAfterPromotion = await verifyLocalRuntimeForReleaseCutover(config);
+      if (!stableAfterPromotion.ok) {
+        const reasonCodes = stableAfterPromotion.runtime.reasonCodes.join(',') || 'unknown';
+        audit(config, 'release_session_cutover_post_promotion_verification_deferred', {
+          sessionId,
+          detail: 'stable Runtime verification is temporarily unavailable after immutable promotion and before activation',
+          reasonCodes,
+        });
+        return {
+          ok: false as const,
+          attempted: false,
+          noOp: true,
+          detail: `RELEASE_SESSION_STABLE_POST_PROMOTION_VERIFICATION_DEFERRED: ${reasonCodes}`,
+          releaseSession: session,
+        };
+      }
+      if (
+        stableAfterPromotion.releases.active?.revision !== session.stableRelease.releaseId
+        || stableAfterPromotion.releases.active?.artifactIdentity !== session.stableRelease.artifactIdentity
+      ) throw new Error('RELEASE_SESSION_STABLE_CHANGED_DURING_PROMOTION');
+
+      // Connector quietness is a cutover invariant, not an automatic-release
+      // policy. Every caller, including explicit/local-recovery ReleaseSession
+      // progression, must prove that no MCP request/stream is active and that
+      // remaining sessions have been idle for the bounded quiet window before
+      // Stable A ownership can move. Otherwise a perfectly valid release switch
+      // can tear down the ChatGPT turn that requested it.
+      let readiness = await probeReleaseCutoverReadiness(config);
+      // The post-promotion verification above may itself create MCP activity
+      // on the primary Connector.  Give that activity a bounded opportunity
+      // to become quiet before deferring the session; otherwise every retry
+      // re-verifies the Runtime, refreshes latestActivityAgeMs, and can defer
+      // forever without ever reaching the cutover attempt.
+      const quietWaitDeadline = Date.now() + AUTOMATIC_RELEASE_CUTOVER_QUIET_MS + 5_000;
+      while (
+        !readiness.ready
+        && readiness.activePosts === 0
+        && readiness.activeStreams === 0
+        && readiness.initializing === 0
+        && Number.isFinite(readiness.latestActivityAgeMs)
+        && (readiness.latestActivityAgeMs ?? AUTOMATIC_RELEASE_CUTOVER_QUIET_MS) < AUTOMATIC_RELEASE_CUTOVER_QUIET_MS
+        && Date.now() < quietWaitDeadline
+      ) {
+        const remainingMs = Math.max(
+          50,
+          AUTOMATIC_RELEASE_CUTOVER_QUIET_MS - (readiness.latestActivityAgeMs ?? 0) + 25,
+        );
+        await sleep(Math.min(2_000, remainingMs));
+        readiness = await probeReleaseCutoverReadiness(config);
+      }
+      if (!readiness.ready) {
+        audit(config, 'release_session_cutover_deferred_for_mcp_activity', {
+          sessionId,
+          detail: readiness.detail,
+          activeSessions: readiness.activeSessions,
+          activePosts: readiness.activePosts,
+          activeStreams: readiness.activeStreams,
+          initializing: readiness.initializing,
+          latestActivityAgeMs: readiness.latestActivityAgeMs,
+          requestKind: requestId?.startsWith('recovery-auto-release:') ? 'automatic' : 'explicit',
+        });
+        return {
+          ok: true as const,
+          attempted: false,
+          noOp: true,
+          detail: `RELEASE_SESSION_CUTOVER_DEFERRED_FOR_MCP_ACTIVITY: ${readiness.detail}`,
+          releaseSession: session,
+        };
+      }
+
+      session = advanceReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId,
+        expectedRevision: session.revision,
+        phase: 'cutover_attempting',
+        receipts: [{
+          id: 'cutover_attempt',
+          kind: 'cutover',
+          summary: `byte-identical Candidate B ${candidateRelease.releaseId} promoted to Stable A release storage; beginning the single fenced cutover attempt`,
+        }],
+      });
+
+      const activation = await activateRuntimeReleaseInternal(config, promoted.manifestPath, {}, {
+        ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
+        expectedAuthorityRevision: session.stableRelease.authorityRevision,
+        expectedActiveReleaseId: session.stableRelease.releaseId,
+        releaseSessionId: session.sessionId,
+      }, releaseSessionLock);
+
+      return reconcileCutoverAttempt(
+        activation.ok
+          ? 'cutover activation completed; reconciling canonical Runtime identity before phase progression'
+          : `cutover activation returned failure: ${activation.detail}`,
+        activation,
+      );
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      const latest = readReleaseSession(config.controllerHome, sessionId) ?? session;
+      session = latest;
+      if (latest.phase === 'cutover_attempting' || latest.phase === 'cutover_committed') {
+        return reconcileCutoverAttempt(`cutover interrupted after entering ${latest.phase}: ${detail}`);
+      }
+      if (latest.phase === 'cutover_eligible') {
+        const retirement = await stopReleaseSessionCandidateService(latest);
+        if (!retirement.ok) {
+          audit(config, 'release_session_candidate_retirement_failed', {
+            sessionId,
+            phase: latest.phase,
+            candidateControllerHome: latest.candidate.controllerHome,
+            detail: retirement.detail,
+            cutoverError: detail,
+          });
+          return {
+            ok: false as const,
+            attempted: false,
+            noOp: true,
+            detail: `${detail}; Candidate B retirement failed: ${retirement.detail}`,
+            releaseSession: latest,
+          };
+        }
+        try {
+          session = advanceReleaseSession({
+            controllerHome: config.controllerHome,
+            sessionId,
+            expectedRevision: latest.revision,
+            phase: 'failed',
+            receipts: [{
+              id: 'cutover_precondition_failed',
+              kind: 'cutover',
+              summary: `${detail}; Candidate B retired`.slice(0, 500),
+            }],
+          });
+          cleanupRetiredCandidateLane(config, session);
+        } catch { /* preserve original cutover precondition failure */ }
+        audit(config, 'release_session_cutover_precondition_failed', {
+          sessionId,
+          detail,
+          candidateRetired: true,
+        });
+      }
+      return { ok: false as const, attempted: false, noOp: true, detail, releaseSession: session };
+    }
+  });
+  if (!locked.acquired) return { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner) };
+  return locked.value;
+}
+
+
+async function cancelReleaseSessionUnderLock(
+  config: RecoveryConfig,
+  initialSession: ReleaseSession,
+  reason: string,
+): Promise<ConfiguredRuntimeActivationResult> {
+  let session = initialSession;
+  if (session.phase === 'failed') {
+    return { ok: true, attempted: false, noOp: true, detail: 'ReleaseSession is already terminal failed', releaseSession: session };
+  }
+  if (['cutover_attempting', 'cutover_committed', 'soaking'].includes(session.phase)) {
+    return {
+      ok: false,
+      attempted: false,
+      noOp: true,
+      detail: `RELEASE_SESSION_CANCEL_AFTER_CUTOVER_FORBIDDEN: ${session.phase}; use exact ReleaseSession rollback/soak resolution`,
+      releaseSession: session,
+    };
+  }
+  if (session.phase === 'known_good' || session.phase === 'rolled_back') {
+    return {
+      ok: false,
+      attempted: false,
+      noOp: true,
+      detail: `RELEASE_SESSION_CANCEL_TERMINAL: ${session.phase}`,
+      releaseSession: session,
+    };
+  }
+
+  const priorPhase = session.phase;
+  if (['candidate_booted', 'candidate_verified', 'cutover_eligible'].includes(session.phase)) {
+    const retirement = await stopReleaseSessionCandidateService(session);
+    if (!retirement.ok) {
+      return {
+        ok: false,
+        attempted: true,
+        detail: `RELEASE_SESSION_CANCEL_CANDIDATE_RETIRE_FAILED: ${retirement.detail}`,
+        releaseSession: session,
+      };
+    }
+  }
+
+  session = advanceReleaseSession({
+    controllerHome: config.controllerHome,
+    sessionId: session.sessionId,
+    expectedRevision: session.revision,
+    phase: 'failed',
+    receipts: [{
+      id: 'candidate_cancelled',
+      kind: 'candidate_canary',
+      summary: `Candidate B was retired before cutover: ${reason}`.slice(0, 500),
+    }],
+  });
+  const cleanup = cleanupRetiredCandidateLane(config, session);
+  audit(config, cleanup.ok ? 'release_session_cancelled' : 'release_session_cancelled_cleanup_failed', {
+    sessionId: session.sessionId,
+    priorPhase,
+    candidateControllerHome: session.candidate.controllerHome,
+    reason,
+    cleanupDetail: cleanup.detail,
+  });
+  return {
+    ok: cleanup.ok,
+    attempted: true,
+    detail: cleanup.ok
+      ? 'ReleaseSession Candidate B was terminalized failed and its isolated lane was retired before cutover; Stable A remained unchanged'
+      : `ReleaseSession was terminalized failed but Candidate B lane cleanup failed: ${cleanup.detail}`,
+    releaseSession: session,
+  };
+}
+
+export async function cancelConfiguredRuntimeReleaseSession(
+  config: RecoveryConfig,
+  sessionId: string,
+  requestId?: string,
+): Promise<ConfiguredRuntimeActivationResult> {
+  const locked = await withLock(config, {
+    action: 'release_session_cancel',
+    ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
   }, async () => {
+    const session = readReleaseSession(config.controllerHome, sessionId);
+    if (!session) return { ok: false as const, attempted: false, noOp: true, detail: 'RELEASE_SESSION_MISSING' };
+    return cancelReleaseSessionUnderLock(config, session, 'explicit Recovery cancellation');
+  });
+  if (!locked.acquired) {
+    return { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner) };
+  }
+  return locked.value;
+}
+
+
+function releaseSessionRollbackTransaction(
+  config: RecoveryConfig,
+  session: ReleaseSession,
+): NonNullable<ReleaseSession['transaction']> {
+  const authority = readRuntimeReleaseAuthority(config.controllerHome);
+  const transaction = session.transaction;
+  const candidateRelease = session.candidateRelease;
+  const previous = authority?.previous;
+  if (!authority || !transaction || !candidateRelease || !previous?.databaseBackup) {
+    throw new Error('RELEASE_SESSION_ROLLBACK_TRANSACTION_REQUIRED');
+  }
+  if (
+    transaction.candidateReleaseId !== candidateRelease.releaseId
+    || authority.active.releaseId !== candidateRelease.releaseId
+    || authority.active.artifactIdentity !== candidateRelease.artifactIdentity
+    || previous.releaseId !== transaction.rollbackRelease.releaseId
+    || previous.artifactIdentity !== transaction.rollbackRelease.artifactIdentity
+    || previous.manifestSha256 !== transaction.rollbackRelease.manifestSha256
+    || previous.databaseBackup.path !== transaction.rollbackRelease.databaseBackup?.path
+    || transaction.rollbackRelease.releaseId !== session.stableRelease.releaseId
+    || transaction.rollbackRelease.artifactIdentity !== session.stableRelease.artifactIdentity
+    || transaction.rollbackRelease.manifestSha256 !== session.stableRelease.manifestSha256
+  ) {
+    throw new Error('RELEASE_SESSION_ROLLBACK_TRANSACTION_IDENTITY_MISMATCH');
+  }
+  return transaction;
+}
+
+/**
+ * A rollback can durably switch release authority before the process gets to
+ * write the ReleaseSession terminal phase. This is sufficient proof only when
+ * the authority operation, Stable A, Candidate B, and fenced transaction all
+ * agree; a merely similar active/previous pair must not terminalize a session.
+ */
+function releaseSessionRollbackAlreadyCommitted(
+  session: ReleaseSession,
+  authority: RuntimeReleaseAuthority | undefined,
+): boolean {
+  const candidateRelease = session.candidateRelease;
+  const transaction = session.transaction;
+  return Boolean(
+    candidateRelease
+    && transaction
+    && authority?.operationId?.startsWith(`release-session-rollback:${session.sessionId}:`)
+    && authority.active.releaseId === session.stableRelease.releaseId
+    && authority.active.artifactIdentity === session.stableRelease.artifactIdentity
+    && authority.active.manifestSha256 === session.stableRelease.manifestSha256
+    && authority.previous?.releaseId === candidateRelease.releaseId
+    && authority.previous?.artifactIdentity === candidateRelease.artifactIdentity
+    && transaction.candidateReleaseId === candidateRelease.releaseId
+    && transaction.rollbackRelease.releaseId === session.stableRelease.releaseId
+    && transaction.rollbackRelease.artifactIdentity === session.stableRelease.artifactIdentity
+  );
+}
+
+export async function rollbackConfiguredRuntimeReleaseSession(
+  config: RecoveryConfig,
+  sessionId: string,
+  dependencies: PrimaryRuntimeRecoveryDependencies = {},
+  requestId?: string,
+): Promise<ConfiguredRuntimeActivationResult> {
+  const locked = await withLock(config, {
+    action: 'release_session_rollback',
+    ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
+  }, async () => {
+    let session = readReleaseSession(config.controllerHome, sessionId);
+    if (!session) return { ok: false as const, attempted: false, noOp: true, detail: 'RELEASE_SESSION_MISSING' };
+    if (session.phase === 'rolled_back') {
+      return { ok: true as const, attempted: false, noOp: true, detail: 'ReleaseSession is already rolled back', releaseSession: session };
+    }
+    if (!['cutover_attempting', 'cutover_committed', 'soaking'].includes(session.phase)) {
+      return {
+        ok: false as const,
+        attempted: false,
+        noOp: true,
+        detail: `RELEASE_SESSION_ROLLBACK_REQUIRES_CUTOVER: ${session.phase}`,
+        releaseSession: session,
+      };
+    }
+
+    const candidateRelease = session.candidateRelease;
+    const transactionBeforeRollback = session.transaction;
+    const authorityBeforeRollback = readRuntimeReleaseAuthority(config.controllerHome);
+    const rollbackAlreadyCommitted = releaseSessionRollbackAlreadyCommitted(
+      session,
+      authorityBeforeRollback,
+    );
+    if (rollbackAlreadyCommitted) {
+      const live = observeRuntimeStatus(config.controllerHome);
+      const stableIsLive = live.running && live.ready && !live.stale
+        && live.snapshot?.releaseId === session.stableRelease.releaseId
+        && live.snapshot?.artifactIdentity === session.stableRelease.artifactIdentity;
+      if (!stableIsLive) {
+        return {
+          ok: false as const,
+          attempted: false,
+          noOp: true,
+          detail: 'RELEASE_SESSION_ROLLBACK_COMMITTED_RUNTIME_NOT_YET_OBSERVED',
+          releaseSession: session,
+        };
+      }
+      session = advanceReleaseSession({
+        controllerHome: config.controllerHome,
+        sessionId,
+        expectedRevision: session.revision,
+        phase: 'rolled_back',
+        receipts: [{
+          id: 'rollback',
+          kind: 'rollback',
+          summary: `reconciled already-committed rollback ${authorityBeforeRollback!.operationId}; exact Stable A ${session.stableRelease.releaseId} is live and no rollback effect was replayed`,
+        }],
+      });
+      audit(config, 'release_session_rollback_reconciled_committed', {
+        sessionId,
+        rollbackOperationId: authorityBeforeRollback!.operationId,
+        restoredStableReleaseId: session.stableRelease.releaseId,
+        candidateReleaseId: candidateRelease!.releaseId,
+      });
+      return {
+        ok: true as const,
+        attempted: false,
+        noOp: true,
+        detail: 'ReleaseSession reconciled the already-committed Stable A rollback from durable authority without replaying the rollback effect',
+        releaseSession: session,
+      };
+    }
+
+    let transaction: NonNullable<ReleaseSession['transaction']>;
     try {
-      const staged = (dependencies.stage ?? stageRuntimeReleaseFromCandidateSource)({ controllerHome: config.controllerHome, sourceRoot, sourceRepositoryId });
-      assertRuntimeReleaseFiles(staged);
-      return { ok: true as const, staged };
+      transaction = releaseSessionRollbackTransaction(config, session);
+    } catch (error) {
+      return {
+        ok: false as const,
+        attempted: false,
+        noOp: true,
+        detail: error instanceof Error ? error.message : String(error),
+        releaseSession: session,
+      };
+    }
+
+    const platform = dependencies.platform ?? process.platform;
+    const uid = await (dependencies.currentUid ?? currentUid)();
+    const service = primaryRuntimeServiceOwner(config, platform, uid);
+    if (!service) {
+      return {
+        ok: false as const,
+        attempted: false,
+        noOp: true,
+        detail: `primary Forge Runtime ${configuredPrimaryRuntimeService(config, platform).platform} service is not installed for ${platform}`,
+        releaseSession: session,
+      };
+    }
+    const runCommand = dependencies.runCommand ?? command;
+    const now = dependencies.now ?? Date.now;
+    const wait = dependencies.sleep ?? sleep;
+    const runtimeRunning = dependencies.runtimeRunning ?? ((value: RecoveryConfig) => observeRuntimeStatus(value.controllerHome).running);
+    const verifyLocal = dependencies.verifyLocal ?? verifyLocalRuntime;
+    const observeLocal = dependencies.observeLocal ?? (dependencies.verifyLocal ? dependencies.verifyLocal : observePrimaryRuntimeActivationReadiness);
+    const repairConnectorBinding = dependencies.repairPrimaryConnectorBinding
+      ?? ((value: RecoveryConfig) => repairPrimaryConnectorBinding(value, platform));
+
+    const stopped = await stopPrimaryRuntimeForReleaseTransition({ config, service, now, wait, runCommand, runtimeRunning });
+    if (!stopped.ok) {
+      return { ok: false as const, attempted: true, detail: stopped.detail, releaseSession: session };
+    }
+
+    let restored: RuntimeReleaseAuthority;
+    let databaseRollbackDisposition: RuntimeDatabaseRollbackDisposition = 'preserved_unversioned_backup';
+    try {
+      const rollbackResult = rollbackRuntimeReleaseWithResult(config.controllerHome, `release-session-rollback:${session.sessionId}:${Date.now()}`);
+      restored = rollbackResult.authority;
+      databaseRollbackDisposition = rollbackResult.databaseDisposition;
+      if (
+        restored.active.releaseId !== session.stableRelease.releaseId
+        || restored.active.artifactIdentity !== session.stableRelease.artifactIdentity
+        || restored.active.manifestSha256 !== session.stableRelease.manifestSha256
+      ) throw new Error('RELEASE_SESSION_ROLLBACK_STABLE_IDENTITY_MISMATCH');
     } catch (error) {
-      return { ok: false as const, detail: error instanceof Error ? error.message : 'Runtime release staging failed' };
+      const restart = await rebindStartAndVerifyPrimaryRuntime({
+        config,
+        service,
+        runCommand,
+        now,
+        wait,
+        verifyLocal,
+        observeLocal,
+        ensureRuntimeLaunchContract: dependencies.ensureRuntimeLaunchContract,
+        timeoutMs: configuredPrimaryRuntimeService(config).postRestartVerifyTimeoutMs ?? 60_000,
+        successDetail: 'ReleaseSession rollback transaction failed; current authoritative Runtime was restarted and verified',
+      });
+      return {
+        ok: false as const,
+        attempted: true,
+        detail: `${error instanceof Error ? error.message : String(error)}; authoritative Runtime restart: ${restart.detail}`,
+        releaseSession: session,
+      };
     }
+
+    let rollbackConnectorBinding: { ok: boolean; attempted: boolean; noOp?: boolean; detail: string } | undefined;
+    const restarted = await rebindStartAndVerifyPrimaryRuntime({
+      config,
+      service,
+      runCommand,
+      now,
+      wait,
+      verifyLocal,
+      observeLocal,
+      ensureRuntimeLaunchContract: dependencies.ensureRuntimeLaunchContract,
+      contractFailureContext: 'after ReleaseSession rollback',
+      timeoutMs: configuredPrimaryRuntimeService(config).postRestartVerifyTimeoutMs ?? 60_000,
+      successDetail: databaseRollbackDisposition === 'restored_backup'
+        ? 'exact Stable A whole-Runtime release and unchanged SQLite backup restored, restarted, rebound, and verified'
+        : 'exact Stable A Runtime release restored while newer live SQLite state was preserved, restarted, rebound, and verified',
+      afterRuntimeReady: async () => {
+        rollbackConnectorBinding = await repairConnectorBinding(config);
+        return rollbackConnectorBinding.ok
+          ? { ok: true, detail: rollbackConnectorBinding.detail }
+          : { ok: false, detail: `Stable A persistent Connector binding failed after ReleaseSession rollback: ${rollbackConnectorBinding.detail}` };
+      },
+    });
+
+    const latest = readReleaseSession(config.controllerHome, sessionId) ?? session;
+    session = advanceReleaseSession({
+      controllerHome: config.controllerHome,
+      sessionId,
+      expectedRevision: latest.revision,
+      phase: restarted.ok ? 'rolled_back' : 'failed',
+      receipts: [{
+        id: restarted.ok ? 'rollback' : 'rollback_failed',
+        kind: 'rollback',
+        summary: restarted.ok
+          ? databaseRollbackDisposition === 'restored_backup'
+            ? `exact Stable A ${latest.stableRelease.releaseId} and its unchanged SQLite backup restored from ReleaseSession activation transaction`
+            : `exact Stable A ${latest.stableRelease.releaseId} restored while newer live SQLite state was preserved across rollback`
+          : `Stable A authority restored but Runtime verification failed after rollback: ${restarted.detail}`.slice(0, 500),
+      }],
+    });
+    audit(config, restarted.ok ? 'release_session_rolled_back' : 'release_session_rollback_restart_failed', {
+      sessionId,
+      releaseSessionTransactionOperationId: transaction.operationId,
+      restoredStableReleaseId: restored.active.releaseId,
+      connectorBindingRepaired: rollbackConnectorBinding?.ok === true,
+      databaseRollbackDisposition,
+      detail: restarted.detail,
+    });
+    return {
+      ok: restarted.ok,
+      attempted: true,
+      detail: restarted.ok
+        ? databaseRollbackDisposition === 'restored_backup'
+          ? 'ReleaseSession rollback restored the exact frozen Stable A release, unchanged SQLite backup, service binding, and verified Runtime'
+          : 'ReleaseSession rollback restored the exact frozen Stable A release while preserving newer live SQLite state, service binding, and verified Runtime'
+        : `ReleaseSession restored Stable A authority but failed post-rollback Runtime verification: ${restarted.detail}`,
+      releaseSession: session,
+    };
   });
-  if (!stagedAttempt.acquired) {
-    return { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(stagedAttempt.owner) };
+  if (!locked.acquired) {
+    return { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner) };
   }
-  if (!stagedAttempt.value.ok) {
-    audit(config, 'runtime_release_stage_failed', { sourceRoot, detail: stagedAttempt.value.detail });
-    return { ok: false, attempted: false, noOp: true, detail: stagedAttempt.value.detail };
+  return locked.value;
+}
+
+
+export async function promoteConfiguredRuntimeReleaseSessionKnownGood(
+  config: RecoveryConfig,
+  sessionId: string,
+  dependencies: RuntimeReleaseKnownGoodDependencies = {},
+  requestId?: string,
+): Promise<ConfiguredRuntimeActivationResult> {
+  const initial = readReleaseSession(config.controllerHome, sessionId);
+  if (!initial) return { ok: false, attempted: false, noOp: true, detail: 'RELEASE_SESSION_MISSING' };
+  if (initial.phase !== 'soaking') {
+    return { ok: false, attempted: false, noOp: true, detail: `RELEASE_SESSION_KNOWN_GOOD_REQUIRES_SOAKING: ${initial.phase}`, releaseSession: initial };
   }
-  const staged: StagedRuntimeRelease = stagedAttempt.value.staged;
-  const activationGuard: RuntimeReleaseActivationGuard = {
-    ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
-    expectedAuthorityRevision: expectedAuthority?.revision ?? null,
-    expectedActiveReleaseId: expectedAuthority?.active.releaseId ?? null,
-  };
-  const activation = dependencies.activate
-    ? await dependencies.activate(config, staged.manifestPath, activationGuard)
-    : await activateRuntimeRelease(config, staged.manifestPath, {}, activationGuard);
-  audit(config, activation.ok ? 'runtime_release_stage_and_activate_succeeded' : 'runtime_release_stage_and_activate_failed', {
-    sourceRoot,
+  // A crash or caller timeout may happen after rollback authority is committed
+  // but before its ReleaseSession receipt is written. Reconcile that terminal
+  // fact before candidate identity or any expensive whole-Runtime acceptance
+  // work; Candidate B is no longer active, so it can never become known-good.
+  if (releaseSessionRollbackAlreadyCommitted(initial, readRuntimeReleaseAuthority(config.controllerHome))) {
+    return rollbackConfiguredRuntimeReleaseSession(
+      config,
+      sessionId,
+      dependencies.rollback ?? {},
+      requestId?.trim() ? `${requestId.trim()}:reconcile-committed-rollback` : undefined,
+    );
+  }
+  const candidateRelease = initial.candidateRelease;
+  if (!candidateRelease) return { ok: false, attempted: false, noOp: true, detail: 'RELEASE_SESSION_CANDIDATE_RELEASE_REQUIRED', releaseSession: initial };
+
+  let attested: ReleaseEvidence;
+  let continuationProof: WorkflowSupervisorContinuationProof;
+  try {
+    const active = activeAuthorityRelease(config);
+    if (
+      !active
+      || active.revision !== candidateRelease.releaseId
+      || active.artifactIdentity !== candidateRelease.artifactIdentity
+      || active.manifestSha256 !== candidateRelease.manifestSha256
+    ) throw new Error('RELEASE_SESSION_SOAK_RUNTIME_IDENTITY_MISMATCH');
+
+    const activeAuthority = readRuntimeReleaseAuthority(config.controllerHome);
+    if (
+      !activeAuthority
+      || activeAuthority.active.releaseId !== candidateRelease.releaseId
+      || activeAuthority.active.artifactIdentity !== candidateRelease.artifactIdentity
+      || activeAuthority.active.manifestSha256 !== candidateRelease.manifestSha256
+    ) throw new Error('RELEASE_SESSION_SOAK_RUNTIME_IDENTITY_MISMATCH');
+    try {
+      const proof = await (dependencies.continuationProof ?? getWorkflowSupervisorContinuationProof)(
+        resolveWorkflowSupervisorForgeHome(config.controllerHome),
+        {
+          ...(candidateRelease.sourceRepositoryId ? { repoId: candidateRelease.sourceRepositoryId } : {}),
+          activeReleaseId: candidateRelease.releaseId,
+          notBefore: activeAuthority.committedAt,
+        },
+      );
+      if (!proof) throw new Error('RELEASE_SESSION_AUTONOMOUS_CONTINUATION_PROOF_MISSING');
+      continuationProof = proof;
+    } catch (error) {
+      if (error instanceof Error && error.message === 'RELEASE_SESSION_AUTONOMOUS_CONTINUATION_PROOF_MISSING') throw error;
+      throw new Error(`RELEASE_SESSION_AUTONOMOUS_CONTINUATION_PROOF_UNAVAILABLE: ${error instanceof Error ? error.message : String(error)}`);
+    }
+
+    const existingAttestation = matchingKnownGood(config, active);
+    if (existingAttestation) {
+      // A known-good attestation is durable release authority, not a transient
+      // observation. Crash/retry reconciliation must reuse it instead of
+      // replaying performance observation and public MCP probes. The live
+      // Runtime still has to own the exact same release and remain locally
+      // live/ready/non-stale before the ReleaseSession can terminalize.
+      if (!liveRuntimeOwnsRelease(config, existingAttestation)) {
+        throw new Error('RELEASE_SESSION_ATTESTED_RUNTIME_NOT_CURRENT');
+      }
+      attested = existingAttestation;
+    } else {
+      const before = await verifyStableRuntime(config);
+      if (!before.ok) throw new Error('RELEASE_SESSION_SOAK_RUNTIME_VERIFY_FAILED');
+      if (!sameReleaseEvidenceIdentity(before.releases.active, active)) {
+        throw new Error('RELEASE_SESSION_SOAK_RUNTIME_IDENTITY_MISMATCH');
+      }
+      attested = await attestKnownGood(config, dependencies);
+    }
+    if (
+      attested.revision !== candidateRelease.releaseId
+      || attested.artifactIdentity !== candidateRelease.artifactIdentity
+      || attested.manifestSha256 !== candidateRelease.manifestSha256
+      || !attested.recoveryBundle
+    ) throw new Error('RELEASE_SESSION_KNOWN_GOOD_ATTESTATION_IDENTITY_MISMATCH');
+    inspectKnownGoodRecoveryBundle(config.controllerHome, attested);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    audit(config, 'release_session_known_good_failed', { sessionId, detail });
+
+    // A hard runaway-CPU rejection is terminal acceptance evidence, not a
+    // transient observation failure. Keeping Candidate B live in `soaking`
+    // caused the automatic release driver to launch another full 60-second
+    // sampler on every reconciliation cycle. Restore the exact frozen Stable A
+    // through the existing ReleaseSession rollback transaction instead. The
+    // coordinator will then treat this source revision as already attempted and
+    // will not autonomously replay it until source authority changes.
+    if (/^RECOVERY_PERFORMANCE_REJECTED:/.test(detail)) {
+      const rollback = await rollbackConfiguredRuntimeReleaseSession(
+        config,
+        sessionId,
+        dependencies.rollback ?? {},
+        requestId?.trim() ? `${requestId.trim()}:performance-rejected` : undefined,
+      );
+      audit(config, 'release_session_known_good_performance_rejected', {
+        sessionId,
+        detail,
+        rollbackOk: rollback.ok,
+        rollbackDetail: rollback.detail,
+      });
+      return {
+        ok: false,
+        attempted: true,
+        detail: rollback.ok
+          ? `${detail}; Candidate B rejected by the Recovery runaway-CPU gate and Stable A restored`
+          : `${detail}; automatic Stable A rollback failed: ${rollback.detail}`,
+        releaseSession: rollback.releaseSession ?? readReleaseSession(config.controllerHome, sessionId) ?? initial,
+      };
+    }
+
+    return { ok: false, attempted: true, detail, releaseSession: readReleaseSession(config.controllerHome, sessionId) ?? initial };
+  }
+
+  const locked = await withLock(config, {
+    action: 'release_session_known_good',
     ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
-    expectedAuthorityRevision: activationGuard.expectedAuthorityRevision,
-    expectedActiveReleaseId: activationGuard.expectedActiveReleaseId,
-    releaseId: staged.releaseId,
-    sourceCommit: staged.sourceCommit,
-    activationAttempted: activation.attempted,
-    activationDetail: activation.detail,
+  }, async () => {
+    let session = readReleaseSession(config.controllerHome, sessionId);
+    if (!session) return { ok: false as const, attempted: true, detail: 'RELEASE_SESSION_MISSING' };
+    if (session.phase !== 'soaking') {
+      return { ok: false as const, attempted: true, detail: `RELEASE_SESSION_CHANGED_DURING_KNOWN_GOOD_ATTESTATION: ${session.phase}`, releaseSession: session };
+    }
+    // The expensive independent verification and performance observation are
+    // already embodied by `attested`. Re-running the full network probe suite
+    // here created a split-brain transaction: the durable recovery bundle could
+    // be published successfully, then one transient Gateway/MCP timeout left the
+    // ReleaseSession permanently soaking. Under the mutation lock, only fence
+    // the identity that could invalidate that attestation.
+    if (!liveRuntimeOwnsRelease(config, attested)) {
+      return { ok: false as const, attempted: true, detail: 'RELEASE_SESSION_RUNTIME_CHANGED_AFTER_KNOWN_GOOD_ATTESTATION', releaseSession: session };
+    }
+    try {
+      releaseSessionRollbackTransaction(config, session);
+    } catch (error) {
+      return {
+        ok: false as const,
+        attempted: true,
+        detail: error instanceof Error ? error.message : String(error),
+        releaseSession: session,
+      };
+    }
+    session = advanceReleaseSession({
+      controllerHome: config.controllerHome,
+      sessionId,
+      expectedRevision: session.revision,
+      phase: 'known_good',
+      receipts: [
+        {
+          id: 'supervisor_continuation_proof',
+          kind: 'soak',
+          summary: `Supervisor task ${continuationProof.taskId} proved ${continuationProof.actions.join(' -> ')} on active release ${continuationProof.activeReleaseId} across Runtime instances ${continuationProof.runtimeInstanceIds.join(',')}`,
+        },
+        {
+          id: 'known_good',
+          kind: 'known_good',
+          summary: `release ${attested.revision} passed soak/performance observation and owns recoverable bundle ${attested.recoveryBundle!.attestationId}`,
+        },
+      ],
+    });
+    audit(config, 'release_session_known_good', {
+      sessionId,
+      releaseId: attested.revision,
+      attestationId: attested.recoveryBundle!.attestationId,
+      releaseAuthorityRevision: attested.releaseAuthorityRevision,
+      releaseSessionTransactionOperationId: session.transaction?.operationId,
+    });
+    return {
+      ok: true as const,
+      attempted: true,
+      detail: 'ReleaseSession became known-good only after full Runtime verification, performance observation, and recoverable release+SQLite+service bundle attestation',
+      releaseSession: session,
+    };
   });
-  return {
-    ok: activation.ok,
-    attempted: activation.attempted,
-    noOp: activation.noOp,
-    detail: activation.ok ? 'configured Runtime source was staged as one immutable release and activated through standalone Recovery' : activation.detail,
-    staged,
-    activation,
-  };
+  if (!locked.acquired) return { ok: false, attempted: false, noOp: true, detail: recoveryBusyDetail(locked.owner), releaseSession: initial };
+  return locked.value;
+}
+
+export interface ConfiguredRuntimeActivationDependencies {
+  stage?: typeof stageRuntimeReleaseFromCandidateSource;
+  activate?: (config: RecoveryConfig, manifestPath: string, guard: RuntimeReleaseActivationGuard) => Promise<RuntimeReleaseActivationResult>;
+}
+
+export async function stageAndActivateConfiguredRuntimeRelease(
+  config: RecoveryConfig,
+  dependencies: ConfiguredRuntimeActivationDependencies = {},
+  requestId?: string,
+): Promise<ConfiguredRuntimeActivationResult> {
+  // Frozen-client compatibility alias. It deliberately stops at Candidate B
+  // build/session preparation. Activation is a separate ReleaseSession phase.
+  return prepareConfiguredRuntimeReleaseSession(config, dependencies, requestId);
 }
 
 function tunnelLaunchdService(configured: RecoveryTunnelServiceConfig | undefined, uid: number): LaunchdService | undefined {
@@ -3276,9 +6629,26 @@ function tunnelRepairAllowed(config: RecoveryConfig, now: number): boolean {
   return typeof prior?.lastAttemptAt !== 'number' || now - prior.lastAttemptAt >= cooldownMs;
 }
 
+async function verifyRecoveryTunnelRepairSurface(config: RecoveryConfig): Promise<VerifyResult> {
+  // Recovery tunnel repair is a bootstrap control-plane operation. It must not
+  // depend on the primary public MCP/Connector transport that Recovery exists
+  // to repair around, and it must stay bounded: the repair runs inside the same
+  // process that serves the Recovery gateway, so strict whole-Runtime or
+  // known-good bundle verification here starves that gateway, delays the tunnel's
+  // own OAuth discovery, and turns a repair into a multi-minute Recovery outage.
+  // Observe canonical Runtime authority/status plus the local Recovery gateway
+  // and the dedicated Recovery transport only.
+  return observeBoundedRuntimeHealth(config, createRecoveryHttpTransport(config.controllerHome), {
+    includePrimaryConnectorLocal: false,
+  });
+}
+
 export async function repairPublicTunnel(config: RecoveryConfig, dependencies: PublicTunnelRepairDependencies = {}): Promise<PublicTunnelRepairResult> {
-  const verify = dependencies.verify ?? verifyStableRuntime;
-  const verifyLocal = dependencies.verifyLocal ?? verifyLocalRuntime;
+  const verify = dependencies.verify ?? verifyRecoveryTunnelRepairSurface;
+  // The repair runs in-process with the Recovery gateway it protects, so the
+  // local precondition uses the same bounded surface instead of strict
+  // whole-Runtime verification.
+  const verifyLocal = dependencies.verifyLocal ?? verifyRecoveryTunnelRepairSurface;
   const now = dependencies.now ?? Date.now;
   const wait = dependencies.sleep ?? sleep;
   const runCommand = dependencies.runCommand ?? command;
@@ -3387,7 +6757,9 @@ export async function repairPublicTunnel(config: RecoveryConfig, dependencies: P
         audit(config, 'public_tunnel_restart_failed', { serviceLabel, serviceTarget, detail });
         return { ok: false, attempted: false, noOp: true, detail, serviceLabel, serviceTarget, verify: before, localVerify: localBefore };
       }
-      const connected = await runCommand('tunnel-client', args, Math.max(30_000, configured.postRestartVerifyTimeoutMs ?? 20_000));
+      const connected = await runCommand('tunnel-client', args, Math.max(30_000, configured.postRestartVerifyTimeoutMs ?? 20_000), {
+        cwd: tunnelClientWorkingDirectory(config.controllerHome),
+      });
       if (!connected.ok) {
         const detail = `OpenAI Secure MCP Tunnel runtime connect failed: ${connected.stderr || connected.stdout || connected.status}`;
         audit(config, 'public_tunnel_restart_failed', { serviceLabel, serviceTarget, detail });
@@ -3453,8 +6825,8 @@ export interface RecoveryWatchdogRestartDependencies extends RecoveryRoleRestart
   probeWatchdog?: (config: RecoveryConfig) => Promise<{ ok: boolean; detail: string }>;
 }
 
-function recoveryRoleLaunchdService(config: RecoveryConfig, uid: number, role: 'gateway' | 'watchdog'): LaunchdService {
-  const label = role === 'gateway' ? RECOVERY_GATEWAY_LABEL : RECOVERY_WATCHDOG_LABEL;
+function recoveryRoleLaunchdService(config: RecoveryConfig, uid: number, _role: 'gateway'): LaunchdService {
+  const label = RECOVERY_DAEMON_LABEL;
   const generated = join(recoveryRoot(config), 'launchd', `${label}.plist`);
   const installed = join(homedir(), 'Library', 'LaunchAgents', `${label}.plist`);
   return {
@@ -3471,19 +6843,14 @@ async function probeRecoveryGateway(config: RecoveryConfig): Promise<{ ok: boole
   return probe(createRecoveryHttpTransport(config.controllerHome), `http://${config.gateway.host}:${config.gateway.port}/health`);
 }
 
-async function probeRecoveryWatchdog(config: RecoveryConfig): Promise<{ ok: boolean; detail: string }> {
-  const health = observeRecoveryWatchdogHealth(config.controllerHome);
-  return { ok: health.ok, detail: health.detail };
-}
-
 async function restartRecoveryRole(input: {
   config: RecoveryConfig;
-  role: 'gateway' | 'watchdog';
-  action: 'restart_recovery_gateway' | 'restart_recovery_watchdog';
+  role: 'gateway';
+  action: 'restart_recovery_gateway';
   check: (config: RecoveryConfig) => Promise<{ ok: boolean; detail: string }>;
   dependencies: RecoveryRoleRestartDependencies;
 }): Promise<RecoveryGatewayRestartResult> {
-  const display = input.role === 'gateway' ? 'Recovery Gateway' : 'Recovery Watchdog';
+  const display = 'Recovery daemon';
   if ((input.dependencies.platform ?? process.platform) !== 'darwin') return { ok: false, attempted: false, noOp: true, detail: `${display} launchd restart is only supported on macOS` };
   const initial = await input.check(input.config);
   if (initial.ok) return { ok: true, attempted: false, noOp: true, detail: `${display} is already healthy` };
@@ -3491,7 +6858,7 @@ async function restartRecoveryRole(input: {
   if (uid === undefined) return { ok: false, attempted: false, noOp: true, detail: `${display} launchd UID is unavailable` };
   const service = recoveryRoleLaunchdService(input.config, uid, input.role);
   if (!existsSync(service.plistPath)) return { ok: false, attempted: false, noOp: true, detail: `${display} launchd plist is missing: ${service.plistPath}`, serviceTarget: service.target };
-  const eventPrefix = input.role === 'gateway' ? 'recovery_gateway' : 'recovery_watchdog';
+  const eventPrefix = 'recovery_daemon';
   const locked = await withLock(input.config, { action: input.action }, async () => {
     const before = await input.check(input.config);
     if (before.ok) return { ok: true, attempted: false, noOp: true, detail: `${display} recovered before restart`, serviceTarget: service.target } satisfies RecoveryGatewayRestartResult;
@@ -3533,19 +6900,6 @@ export async function restartRecoveryGateway(
   });
 }
 
-export async function restartRecoveryWatchdog(
-  config: RecoveryConfig,
-  dependencies: RecoveryWatchdogRestartDependencies = {},
-): Promise<RecoveryWatchdogRestartResult> {
-  return restartRecoveryRole({
-    config,
-    role: 'watchdog',
-    action: 'restart_recovery_watchdog',
-    check: dependencies.probeWatchdog ?? probeRecoveryWatchdog,
-    dependencies,
-  });
-}
-
 function pidAlive(pid: number | undefined): boolean {
   if (typeof pid !== 'number' || !Number.isInteger(pid) || pid <= 0) return false;
   try { process.kill(pid, 0); return true; } catch { return false; }
@@ -3565,7 +6919,7 @@ export function gatewayToken(config: RecoveryConfig): string | undefined {
 export function initializeStandaloneRecovery(
   controllerHome: string,
   port = 8787,
-  extensions: Partial<Pick<RecoveryConfig, 'publicMcpUrl' | 'recoveryPublicUrl' | 'recoveryTunnelService' | 'primaryPublicTunnelService' | 'primaryRuntimeService' | 'primaryRuntimeSourceRoot' | 'primaryRuntimeSourceRepositoryId' | 'primaryConnectorService' | 'readOnlyTool'>> = {},
+  extensions: Partial<Pick<RecoveryConfig, 'installProfile' | 'publicMcpUrl' | 'recoveryPublicUrl' | 'recoveryTunnelService' | 'primaryPublicTunnelService' | 'primaryRuntimeService' | 'primaryRuntimeSourceRoot' | 'primaryRuntimeSourceRepositoryId' | 'primaryConnectorService' | 'readOnlyTool'>> = {},
 ): RecoveryConfig {
   const root = resolve(controllerHome);
   const tokenPath = join(root, 'recovery', 'config', 'gateway-token.json');
@@ -3604,27 +6958,17 @@ export async function watchdogTick(config: RecoveryConfig, prior: WatchdogState)
     now,
     watchdogRuntimeStartupGraceMs(config),
   );
-  // Five-second watchdog ticks must stay cheap while the system is healthy.
-  // Full MCP protocol verification serializes the entire tool surface, so run
-  // it periodically and immediately escalate to it when a local health probe
-  // fails. A live Runtime that was just started gets a bounded grace window so
-  // startup/reconciliation cannot itself trigger a Recovery restart storm.
-  // Explicit verify/attest/release operations remain strict by default.
-  const fullVerifyDue = !runtimeStartupGrace
-    && (scopedPrior.lastFullVerifyAt === undefined || now - scopedPrior.lastFullVerifyAt >= 60_000);
-  let fullVerificationPerformed = fullVerifyDue;
-  let verified = await verifyStableRuntime(
-    config,
-    createRecoveryHttpTransport(config.controllerHome),
-    { probeMcpProtocol: fullVerifyDue },
-  );
-  let localVerify = await verifyLocalRuntime(config, { probeMcpProtocol: fullVerifyDue });
-  if (!localVerify.ok && !fullVerifyDue && !runtimeStartupGrace) {
-    verified = await verifyStableRuntime(config);
-    localVerify = await verifyLocalRuntime(config);
-    fullVerificationPerformed = true;
-  }
-  const lastFullVerifyAt = fullVerificationPerformed ? now : scopedPrior.lastFullVerifyAt;
+  // Watchdog owns bounded health observation only. Never run strict Runtime or
+  // known-good bundle verification from startup or the five-second tick, even
+  // when the bounded tier degrades: those checks can hash/inspect multi-GB
+  // recovery evidence and would make liveness depend on release-acceptance cost.
+  // Explicit verify/attest/release/rollback operations remain the sole strict
+  // recoverability boundaries. Keep the legacy timestamp as non-authoritative
+  // compatibility state so existing persisted WatchdogState remains readable.
+  const health = await observeWatchdogHealthTier(config);
+  const verified = health;
+  const localVerify = health;
+  const lastFullVerifyAt = scopedPrior.lastFullVerifyAt ?? now;
   const activeMutation = liveRecoveryMutationLock(config);
   if (activeMutation) {
     const attributable = recoveryLockOwnerAttributable(activeMutation);
@@ -3654,7 +6998,7 @@ export async function watchdogTick(config: RecoveryConfig, prior: WatchdogState)
     };
     return { state, decision: { action: 'degraded', reason }, verify: verified };
   }
-  if (runtimeStartupGrace && !localVerify.ok) {
+  if (runtimeStartupGrace && !localVerify.runtime.ok) {
     const state: WatchdogState = {
       ...scopedPrior,
       failures: 0,
@@ -3670,8 +7014,24 @@ export async function watchdogTick(config: RecoveryConfig, prior: WatchdogState)
       verify: verified,
     };
   }
+  // Recovery is only usable when the transport the Recovery connector actually
+  // reaches is itself verified. Treat the configured Recovery transport as part
+  // of the recovery-health gate so a dead tunnel degrades the watchdog and
+  // reaches the bounded `repair_public_tunnel` path instead of reporting healthy.
+  const recoveryTransportHealthy = configuredRecoveryTunnel(config)?.platform === 'openai-secure-tunnel'
+    ? verified.probes.recovery_tunnel_runtime?.ok === true
+    : verified.probes.recovery_external_http?.ok !== false;
   const recoveryHealthy = verified.probes.recovery_gateway?.ok !== false
-    && verified.probes.recovery_external_http?.ok !== false;
+    && recoveryTransportHealthy;
+  const recoveryTunnelObservation = openAiTunnelObservationFromProbe(verified.probes.recovery_tunnel_runtime);
+  if (isUpstreamOpenAiControlPlaneIncident(recoveryTunnelObservation) && scopedPrior.failures === 0) {
+    await persistOpenAiTransportIncidentEvidence({
+      config,
+      verify: verified,
+      runtimeObservation,
+      recoveryTunnel: recoveryTunnelObservation!,
+    });
+  }
   const primaryRuntimeHealthy = canonicalRuntimeSafeForTargetedConnectorRecovery(localVerify);
   const primaryConnectorConfigured = Boolean(config.primaryConnectorService);
   const primaryConnectorLocalFailed = verified.probes.primary_connector_local?.ok === false;