chati-dev 4.5.28 → 4.5.29

package/node_modules/@chati/rail/src/index.js

@@ -1,14 +1,24 @@
 import {
-  closeSync, constants, existsSync, fstatSync, fsyncSync, ftruncateSync, lstatSync, mkdirSync,
-  openSync, readSync, renameSync, unlinkSync, writeSync,
+  closeSync, constants, fstatSync, fsyncSync, ftruncateSync,
+  openSync, readSync, writeSync,
 } from 'node:fs';
 import { hostname } from 'node:os';
 import { randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { basename, dirname, join, parse, resolve, sep } from 'node:path';
-import { ContractError, canonicalize, sha256 } from '@chati/core';
+import {
+  ContractError, canonicalize, sha256, directoryPathSync, openAtSync,
+  mkdirAtSync, lstatAtSync, renameAtSync, unlinkAtSync, assertLinuxNamespaceIdentity, observeLinuxNamespace,
+  assertDarwinHostBootIdentity, captureDarwinHostBootIdentity, compareDarwinHostBootIdentity, observeDarwinPreviousBoot,
+  tryExclusiveFileLockSync, captureHostBootMarker, hostBootMarkerChanged,
+} from '@chati/core';
 import { createAttemptBinding, validateAttemptBinding, verifyLocalGitCommit } from '@chati/planning';
 import { acceptReview, decideReviewProgress, selectCanonicalReviewer, validateAdjudicationDecision } from '@chati/review-council';
+import { assertEligibleInvocation } from '@chati/provider-registry';
+import { assertProviderProcessOutput, assertProviderProcessReceipt, collectProviderProcessing, providerProcessDispatches, providerProcessingMetric } from './provider-processing.js';
+import { assertExecutionInterruptionLifetime, executionCheckpointBinding, restoredExecutionProof, isWellFormedTerminationAttestation } from './execution-restoration.js';
+import { assertTerminalLaunchContainment, assertTerminalCompletionContainment } from './terminal-containment.js';
+export { collectProviderProcessing, providerProcessingMetric } from './provider-processing.js';
 
 const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
 const TASK_CLOSED_STATES = new Set(['merged', 'blocked', 'cancelled']);
@@ -68,6 +78,25 @@ function assertAllowedKeys(value, allowed, code, label) {
   if (Object.keys(value).some((key) => !allowed.has(key))) fail(code, `${label} contains unsupported fields`);
 }
 
+/** Acceptance must certify the values as well as the underlying source refs. */
+export function completionMetricsReference({ attempt_id, commit_ref, metrics } = {}) {
+  assertString(attempt_id, 'INVALID_COMPLETION_METRICS', 'attempt_id');
+  assertString(commit_ref, 'INVALID_COMPLETION_METRICS', 'commit_ref');
+  assertObject(metrics, 'INVALID_COMPLETION_METRICS', 'metrics');
+  return `rail-metrics://sha256/${sha256({ schema_version: 1, attempt_id, commit_ref, metrics })}`;
+}
+
+export function effortJournalDigest(records, attempt_id) {
+  const types = new Set(['human_effort_observed', 'provider_process_observed', 'execution_dispatched',
+    'execution_recorded', 'review_dispatched', 'review_decided', 'adjudication_dispatched',
+    'adjudication_observed', 'adjudication_decided', 'execution_interruption_observed',
+    'execution_checkpoint_preserved', 'execution_worktree_restored', 'attempt_recovered']);
+  return sha256(records.filter((record) => types.has(record.type) && record.payload?.attempt_id === attempt_id
+    // Ordinary ownership renewal adds no measurement. Only consumption of an
+    // interrupted dispatch changes processing coverage.
+    && (record.type !== 'attempt_recovered' || record.payload.reconciliation?.execution_dispatches?.length > 0)));
+}
+
 export function browserEvidenceMaterial(evidence = {}) {
   return canonicalize({
     schema_version: evidence.schema_version,
@@ -164,7 +193,8 @@ function validateRealBrowserEvidence({
     purpose: 'rail_evidence', authority_kind: 'rail_browser', attempt_id: attemptId,
     commit_ref: commitRef, verdict: 'passed', evidence_digest: sha256(material),
     observed_at: evidence.observed_at,
-  });
+  }, { artifacts: evidence.artifacts, policy_ref: evidence.policy_ref, browser_session_id: evidence.browser_session_id,
+    captured_at: evidence.observed_at });
   return canonicalize(evidence);
 }
 
@@ -278,69 +308,43 @@ function stableEventId(sequence, event) {
 function checkpointPath(journalPath) { return `${journalPath}.checkpoint`; }
 function lockPath(journalPath) { return `${journalPath}.lock`; }
 
-function ensureSafeDirectory(path, { create = false } = {}) {
-  const absolute = resolve(path);
-  const root = parse(absolute).root;
-  let current = root;
-  for (const segment of absolute.slice(root.length).split(sep).filter(Boolean)) {
-    current = resolve(current, segment);
-    let stat;
-    try { stat = lstatSync(current); }
-    catch (error) {
-      if (error?.code !== 'ENOENT' || !create) throw error;
-      try { mkdirSync(current, { mode: 0o700 }); }
-      catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
-      stat = lstatSync(current);
-    }
-    if (stat.isSymbolicLink() || !stat.isDirectory()) {
-      fail('UNSAFE_JOURNAL_DIRECTORY', 'journal directory chain must contain only real directories', { path: current });
-    }
-  }
-  return absolute;
-}
-
 function openDirectoryForSync(path, { create = false } = {}) {
+  if (!['linux', 'darwin'].includes(process.platform)) {
+    fail('UNSUPPORTED_JOURNAL_STORAGE_PLATFORM', `journal storage requires descriptor-relative operations; unsupported platform: ${process.platform}`);
+  }
   const absolute = resolve(path);
-  if (process.platform === 'linux') {
-    const root = parse(absolute).root;
-    const segments = absolute.slice(root.length).split(sep).filter(Boolean);
-    let fd = openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
-    try {
-      for (const segment of segments) {
-        const childPath = join(`/proc/self/fd/${fd}`, segment);
-        let childFd;
-        try {
-          childFd = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
-        } catch (error) {
-          if (error?.code !== 'ENOENT' || !create) {
-            if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
-              fail('UNSAFE_JOURNAL_DIRECTORY', 'journal directory chain must contain only real directories');
-            }
-            throw error;
+  const root = parse(absolute).root;
+  const segments = absolute.slice(root.length).split(sep).filter(Boolean);
+  let fd = openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+  try {
+    for (const segment of segments) {
+      let childFd;
+      try {
+        childFd = openAtSync(fd, segment, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      } catch (error) {
+        if (error?.code !== 'ENOENT' || !create) {
+          if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
+            fail('UNSAFE_JOURNAL_DIRECTORY', 'journal directory chain must contain only real directories');
           }
-          try { mkdirSync(childPath, { mode: 0o700 }); }
-          catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
-          childFd = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
-        }
-        const childStat = fstatSync(childFd);
-        if (!childStat.isDirectory()) {
-          closeSync(childFd);
-          fail('UNSAFE_JOURNAL_DIRECTORY', 'journal directory chain must contain only real directories');
+          throw error;
         }
-        closeSync(fd);
-        fd = childFd;
+        try { mkdirAtSync(fd, segment, { mode: 0o700 }); }
+        catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
+        childFd = openAtSync(fd, segment, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      }
+      const childStat = fstatSync(childFd);
+      if (!childStat.isDirectory()) {
+        closeSync(childFd);
+        fail('UNSAFE_JOURNAL_DIRECTORY', 'journal directory chain must contain only real directories');
       }
-      return { fd, path: absolute, stat: fstatSync(fd), reference: `/proc/self/fd/${fd}` };
-    } catch (error) {
       closeSync(fd);
-      throw error;
+      fd = childFd;
     }
+    return { fd, path: absolute, stat: fstatSync(fd) };
+  } catch (error) {
+    closeSync(fd);
+    throw error;
   }
-  const safePath = ensureSafeDirectory(absolute, { create });
-  const fd = openSync(safePath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
-  const stat = fstatSync(fd);
-  if (!stat.isDirectory()) { closeSync(fd); fail('UNSAFE_JOURNAL_DIRECTORY', 'journal parent must be a directory'); }
-  return { fd, path: safePath, stat, reference: safePath };
 }
 
 function sameIdentity(left, right) {
@@ -373,10 +377,10 @@ function readDescriptorBounded(fd, maxBytes, code, label) {
   return Buffer.concat(chunks, total).toString('utf8');
 }
 
-function readRegularBoundedRecord(path, { allowMissing = false, label = 'journal', maxBytes = JOURNAL_MAX_BYTES } = {}) {
+function readRegularBoundedRecord(directory, name, { allowMissing = false, label = 'journal', maxBytes = JOURNAL_MAX_BYTES } = {}) {
   let fd;
   try {
-    fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    fd = openAtSync(directory.fd, name, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
   } catch (error) {
     if (allowMissing && error?.code === 'ENOENT') return null;
     if (['ELOOP', 'ENXIO', 'EISDIR'].includes(error?.code)) fail('UNSAFE_JOURNAL_FILE', `${label} must not be a symlink, FIFO or directory`);
@@ -386,7 +390,7 @@ function readRegularBoundedRecord(path, { allowMissing = false, label = 'journal
     const stat = fstatSync(fd);
     if (!stat.isFile() || stat.nlink !== 1) fail('UNSAFE_JOURNAL_FILE', `${label} must be a regular single-link file`);
     if (stat.size > maxBytes) fail('JOURNAL_SIZE_LIMIT', `${label} exceeds its safety limit`);
-    runSecurityTestHook('afterJournalStateStat', { path, label, fd });
+    runSecurityTestHook('afterJournalStateStat', { path: join(directoryPathSync(directory.fd), name), label, fd });
     const content = readDescriptorBounded(fd, maxBytes, 'JOURNAL_SIZE_LIMIT', label);
     const after = fstatSync(fd);
     if (!sameSnapshot(stat, after)) fail('JOURNAL_STORAGE_CONFLICT', `${label} changed while it was read`);
@@ -394,8 +398,8 @@ function readRegularBoundedRecord(path, { allowMissing = false, label = 'journal
   } finally { closeSync(fd); }
 }
 
-function readRegularBounded(path, options) {
-  return readRegularBoundedRecord(path, options)?.content ?? null;
+function readRegularBounded(directory, name, options) {
+  return readRegularBoundedRecord(directory, name, options)?.content ?? null;
 }
 
 function processIsAlive(pid) {
@@ -403,9 +407,9 @@ function processIsAlive(pid) {
   try { process.kill(pid, 0); return true; } catch (error) { return error?.code === 'EPERM'; }
 }
 
-function readLockOwner(path) {
+function readLockOwner(directory, name) {
   try {
-    const raw = readRegularBounded(path, { allowMissing: true, label: 'journal lock', maxBytes: 16 * 1024 });
+    const raw = readRegularBounded(directory, name, { allowMissing: true, label: 'journal lock', maxBytes: 16 * 1024 });
     if (raw === null) return null;
     const owner = JSON.parse(raw);
     if (!owner || typeof owner !== 'object' || typeof owner.token !== 'string') return null;
@@ -413,58 +417,108 @@ function readLockOwner(path) {
   } catch { return null; }
 }
 
-function recoverStaleLock(path) {
+function lockOwnerMayBeStopped(owner, hostBootIdentity) {
+  if (owner?.darwin_host_boot_identity) {
+    try {
+      if (compareDarwinHostBootIdentity(owner.darwin_host_boot_identity, hostBootIdentity) === 'previous-boot') return true;
+    } catch { return false; }
+  }
+  if (owner?.hostname && owner.hostname !== hostname()) return false;
+  // A changed kernel boot marker proves a same-hostname owner's PID cannot be
+  // the one that wrote the lock, even if the numeric PID has since been reused.
+  // Darwin identity above is authoritative and already free of native re-reads;
+  // never spend a second native observation confirming what it already proved.
+  if (!hostBootIdentity && owner?.hostname === hostname() && hostBootMarkerChanged(owner.host_boot_marker, captureHostBootMarker())) return true;
+  return !(owner?.hostname === hostname() && processIsAlive(owner.pid));
+}
+
+function recoverStaleLock(directory, name, hostBootIdentity) {
   let stat;
-  try { stat = lstatSync(path); } catch (error) { return error?.code === 'ENOENT'; }
+  try { stat = lstatAtSync(directory.fd, name); } catch (error) { return error?.code === 'ENOENT'; }
   if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) return false;
-  const owner = readLockOwner(path);
-  const sameHostOwnerAlive = owner?.hostname === hostname() && processIsAlive(owner.pid);
-  if (sameHostOwnerAlive) return false;
-  // Cross-host liveness cannot be proven from a local PID namespace. Remote
-  // locks are never stolen automatically; an operator must reconcile/remove
-  // them after proving the owner is gone.
-  if (owner?.hostname && owner.hostname !== hostname()) return false;
+  const owner = readLockOwner(directory, name);
+  // A native prior-boot owner is gone even if its PID has since been recycled.
+  // Remote/malformed identities remain unprovable and are never stolen.
+  if (!lockOwnerMayBeStopped(owner, hostBootIdentity)) return false;
   if (!owner && Date.now() - stat.mtimeMs < LOCK_STALE_AFTER_MS) return false;
-  const recoveryPath = `${path}.recovery`;
+  const recoveryName = `${name}.recovery`;
+  // Skip on Darwin: its identity above is already authoritative, and capturing
+  // a marker there would cost a second native host observation for nothing.
+  const bootMarker = hostBootIdentity ? null : captureHostBootMarker();
   let recoveryFd;
   try {
-    recoveryFd = openSync(recoveryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
-    const recoveryBytes = Buffer.from(JSON.stringify({ pid: process.pid, hostname: hostname(), token: randomUUID() }));
+    if (hostBootIdentity) {
+      let created = false;
+      try {
+        recoveryFd = openAtSync(directory.fd, recoveryName, constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        created = true;
+      } catch (error) {
+        if (error.code !== 'EEXIST') throw error;
+        recoveryFd = openAtSync(directory.fd, recoveryName, constants.O_RDWR | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+      }
+      const recoveryStat = fstatSync(recoveryFd);
+      if (!recoveryStat.isFile() || recoveryStat.nlink !== 1
+        || !sameIdentity(recoveryStat, lstatAtSync(directory.fd, recoveryName))
+        || !tryExclusiveFileLockSync(recoveryFd)) throw new Error('recovery guard is not exclusively held');
+      const priorOwner = readLockOwner(directory, recoveryName);
+      if (!created && priorOwner?.kind !== 'darwin_journal_recovery_flock_v1'
+        && (!lockOwnerMayBeStopped(priorOwner, hostBootIdentity)
+          || (!priorOwner && Date.now() - recoveryStat.mtimeMs < LOCK_STALE_AFTER_MS))) {
+        throw new Error('legacy recovery guard owner is unproven');
+      }
+      // This inode persists: the OS releases its flock on crash/boot. Unlinking
+      // it would let concurrent recoverers acquire different inodes as owners.
+      ftruncateSync(recoveryFd, 0);
+    } else {
+      recoveryFd = openAtSync(directory.fd, recoveryName, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    }
+    const recoveryBytes = Buffer.from(JSON.stringify({ pid: process.pid, hostname: hostname(), token: randomUUID(),
+      ...(hostBootIdentity ? { kind: 'darwin_journal_recovery_flock_v1', darwin_host_boot_identity: hostBootIdentity } : {}),
+      ...(bootMarker ? { host_boot_marker: bootMarker } : {}) }));
     writeSync(recoveryFd, recoveryBytes, 0, recoveryBytes.length);
     fsyncSync(recoveryFd);
   } catch {
     if (recoveryFd !== undefined) closeSync(recoveryFd);
     return false;
   }
-  const quarantine = `${path}.stale.${process.pid}.${Date.now()}`;
+  const quarantine = `${name}.stale.${process.pid}.${Date.now()}`;
   try {
-    const current = lstatSync(path);
-    const currentOwner = readLockOwner(path);
+    const current = lstatAtSync(directory.fd, name);
+    const currentOwner = readLockOwner(directory, name);
     if (!sameIdentity(stat, current) || currentOwner?.token !== owner?.token) return false;
-    renameSync(path, quarantine);
-    const quarantined = lstatSync(quarantine);
-    const quarantinedOwner = readLockOwner(quarantine);
+    renameAtSync(directory.fd, name, directory.fd, quarantine);
+    const quarantined = lstatAtSync(directory.fd, quarantine);
+    const quarantinedOwner = readLockOwner(directory, quarantine);
     if (!sameIdentity(stat, quarantined) || quarantinedOwner?.token !== owner?.token) {
-      try { if (!existsSync(path)) renameSync(quarantine, path); } catch { /* preserve quarantine fail-closed */ }
+      try { lstatAtSync(directory.fd, name); }
+      catch (error) {
+        if (error?.code === 'ENOENT') {
+          try { renameAtSync(directory.fd, quarantine, directory.fd, name); } catch { /* preserve quarantine fail-closed */ }
+        }
+      }
       return false;
     }
-    unlinkSync(quarantine);
+    unlinkAtSync(directory.fd, quarantine);
     return true;
   } catch (error) {
     if (error?.code === 'ENOENT') return true;
     return false;
   } finally {
     if (recoveryFd !== undefined) closeSync(recoveryFd);
-    try { unlinkSync(recoveryPath); } catch { /* fail closed if another process changed it */ }
+    if (!hostBootIdentity) {
+      try { unlinkAtSync(directory.fd, recoveryName); } catch { /* fail closed if another process changed it */ }
+    }
   }
 }
 
 function parseJournal(journalPath, { repair = false, directory = null } = {}) {
-  if (!directory) ensureSafeDirectory(dirname(journalPath));
-  const activeJournalPath = directory
-    ? join(directory.reference, basename(journalPath))
-    : journalPath;
-  const journal = readRegularBoundedRecord(activeJournalPath, { allowMissing: true });
+  if (!directory) {
+    const openedDirectory = openDirectoryForSync(dirname(journalPath));
+    try { return parseJournal(journalPath, { repair, directory: openedDirectory }); }
+    finally { closeSync(openedDirectory.fd); }
+  }
+  const journalName = basename(journalPath);
+  const journal = readRegularBoundedRecord(directory, journalName, { allowMissing: true });
   const rawJournal = journal?.content ?? null;
   const raw = rawJournal ?? '';
   const hasTail = Boolean(raw && !raw.endsWith('\n'));
@@ -499,10 +553,7 @@ function parseJournal(journalPath, { repair = false, directory = null } = {}) {
       completeTail = true;
     } catch { /* the durable checkpoint decides whether partial bytes are repairable */ }
   }
-  const checkpointFile = directory
-    ? join(directory.reference, basename(checkpointPath(journalPath)))
-    : checkpointPath(journalPath);
-  const rawCheckpoint = readRegularBounded(checkpointFile, {
+  const rawCheckpoint = readRegularBounded(directory, basename(checkpointPath(journalPath)), {
     allowMissing: true, label: 'journal checkpoint', maxBytes: JOURNAL_RECORD_MAX_BYTES,
   });
   let checkpoint = null;
@@ -546,7 +597,7 @@ function parseJournal(journalPath, { repair = false, directory = null } = {}) {
   }
   let identity = journal?.stat ?? null;
   if ((safeIncompleteTail || missingDelimiter) && repair) {
-    const fd = openSync(activeJournalPath, constants.O_RDWR | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    const fd = openAtSync(directory.fd, journalName, constants.O_RDWR | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
     try {
       const before = fstatSync(fd);
       if (!before.isFile() || before.nlink !== 1) fail('UNSAFE_JOURNAL_FILE', 'journal must be a regular single-link file');
@@ -574,11 +625,7 @@ function parseJournal(journalPath, { repair = false, directory = null } = {}) {
       }
       identity = afterRead;
     } finally { closeSync(fd); }
-    if (directory) fsyncSync(directory.fd);
-    else {
-      const openedDirectory = openDirectoryForSync(dirname(journalPath));
-      try { fsyncSync(openedDirectory.fd); } finally { closeSync(openedDirectory.fd); }
-    }
+    fsyncSync(directory.fd);
   }
   if (rawJournal === null && checkpoint !== null && !validCommittedState && !validPendingState) {
     fail('JOURNAL_TRUNCATION_DETECTED', 'journal file is missing below its durable high-water mark');
@@ -590,6 +637,12 @@ function isExpired(claim, now) {
   return Date.parse(claim.lease.expires_at) <= Date.parse(now);
 }
 
+export function attemptJournalRevision(records, attemptId) {
+  return [...records].reverse().find((record) => record.payload?.attempt_id === attemptId
+    || record.payload?.attempt?.attempt_id === attemptId
+    || record.payload?.completion?.attempt_id === attemptId)?.event_id;
+}
+
 function claimProcessPid(attempt) {
   const match = /^process:\/\/chati\/(\d+)$/.exec(attempt.claim.harness_process_id || '');
   if (!match) fail('RECOVERY_PROCESS_UNRESOLVED', 'claim process identity is not locally observable');
@@ -597,10 +650,15 @@ function claimProcessPid(attempt) {
 }
 
 function observeStoppedClaimProcess(attempt) {
+  const pid = claimProcessPid(attempt);
+  if (attempt.claim.darwin_host_boot_identity) {
+    const boot = compareDarwinHostBootIdentity(attempt.claim.darwin_host_boot_identity, captureDarwinHostBootIdentity());
+    // Do not probe a numeric PID from an earlier boot, even if now reused.
+    if (boot === 'previous-boot') return pid;
+  }
   if (attempt.claim.hostname !== hostname()) {
     fail('RECOVERY_REMOTE_PROCESS_UNVERIFIABLE', 'automatic recovery cannot prove a process stopped on another host');
   }
-  const pid = claimProcessPid(attempt);
   try {
     process.kill(pid, 0);
     fail('RECOVERY_PROCESS_STILL_RUNNING', 'the prior claim process is still running', { pid });
@@ -625,6 +683,16 @@ function verifyCommitDescendsFrom({ git_dir, base_commit_ref, result_commit_ref
   }
 }
 
+/** Legacy attempts retain their original base; new bases are bound at claim. */
+export function attemptExecutionBase(attempt) {
+  const base = attempt.execution_base_commit_ref === undefined
+    ? attempt.git_commit_ref : attempt.execution_base_commit_ref;
+  if (typeof base !== 'string' || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(base)) {
+    fail('INVALID_ATTEMPT_EXECUTION_BASE', 'attempt execution base must be a full Git object ID');
+  }
+  return base;
+}
+
 /**
  * C-04/C-06 local engine. Every mutable operational fact is represented by a
  * new journal event. The journal itself is canonical for this package.
@@ -636,8 +704,10 @@ export class RailEngine {
   #activeDirectory;
   #journalIdentity;
   #authorityVerifier;
+  #checkpointWriter;
+  #restorationWriter;
 
-  constructor({ journal_path, clock, authority_verifier = null } = {}) {
+  constructor({ journal_path, clock, authority_verifier = null, execution_checkpoint_writer = null, execution_restoration_writer = null } = {}) {
     assertString(journal_path, 'INVALID_JOURNAL_PATH', 'journal_path');
     this.#journalPath = journal_path;
     this.#clock = clock;
@@ -645,6 +715,14 @@ export class RailEngine {
       fail('INVALID_RAIL_AUTHORITY_VERIFIER', 'authority_verifier must be a function');
     }
     this.#authorityVerifier = authority_verifier;
+    if (execution_checkpoint_writer !== null && typeof execution_checkpoint_writer !== 'function') {
+      fail('INVALID_CHECKPOINT_WRITER', 'checkpoint writer must be an explicitly configured host adapter');
+    }
+    this.#checkpointWriter = execution_checkpoint_writer;
+    if (execution_restoration_writer !== null && typeof execution_restoration_writer !== 'function') {
+      fail('INVALID_RESTORATION_WRITER', 'restoration writer must be an explicitly configured host adapter');
+    }
+    this.#restorationWriter = execution_restoration_writer;
     const loaded = parseJournal(journal_path);
     this.#records = loaded.records;
     this.#journalIdentity = loaded.identity;
@@ -653,12 +731,89 @@ export class RailEngine {
   get journalPath() { return this.#journalPath; }
   get records() { return Object.freeze([...this.#records]); }
 
-  #verifyAuthority(kind, receipt, expected) {
-    if (!this.#authorityVerifier || this.#authorityVerifier({ kind, receipt, expected }) !== true) {
+  #verifyAuthority(kind, receipt, expected, context) {
+    if (!this.#authorityVerifier || this.#authorityVerifier({ kind, receipt, expected, ...(context ? { context } : {}) }) !== true) {
       fail('UNTRUSTED_RAIL_AUTHORITY_RECEIPT', `${kind} requires a receipt from the configured terminal authority`);
     }
   }
 
+  #assertAttemptRevision(attemptId, expected) {
+    if (expected === undefined) return;
+    assertString(expected, 'INVALID_RECOVERY_CONTEXT', 'expected_attempt_event_id');
+    if (attemptJournalRevision(this.#records, attemptId) !== expected) {
+      fail('RECOVERY_CONTEXT_CHANGED', 'attempt changed after recovery stage selection; reload its canonical state');
+    }
+  }
+
+  #verifyExecutionAdmission({ attempt, invocation, receipt, project_dir, harness_process_id }) {
+    assertString(project_dir, 'INVALID_EXECUTION_ADMISSION', 'project_dir');
+    assertObject(receipt, 'INVALID_EXECUTION_ADMISSION', 'admission receipt');
+    const base = this.#executionEvidence(attempt.attempt_id, { successfulOnly: true })
+      .at(-1)?.result_commit_ref ?? attemptExecutionBase(attempt);
+    this.#verifyAuthority('execution_admission', receipt, {
+      purpose: 'terminal_execution_admission', authority_kind: 'rail_execution',
+      execution_admission_protocol: 'native-positive-go-v1',
+      invocation_id: invocation.invocation_id, launch_nonce: invocation.launch_nonce,
+      task_id: attempt.task_id, working_dir: resolve(project_dir), prompt_digest: invocation.prompt_digest,
+      provider_id: invocation.provider_id, harness_id: invocation.harness_id,
+      model_id: invocation.model_pin?.model_id,
+      reasoning_configuration: invocation.model_pin?.reasoning_configuration,
+      supervisor_process_id: harness_process_id, supervisor_hostname: attempt.claim.hostname,
+      execution_base_commit_ref: base, execution_launch_head_ref: base, execution_worktree_clean: true,
+    });
+    if (attempt.claim.darwin_host_boot_identity) {
+      assertDarwinHostBootIdentity(receipt.darwin_host_boot_identity);
+      if (sha256(receipt.darwin_host_boot_identity) !== sha256(attempt.claim.darwin_host_boot_identity)) {
+        fail('EXECUTION_ADMISSION_HOST_BOOT_MISMATCH', 'admission must belong to the exact native supervisor host and boot');
+      }
+    }
+    if (!/^[a-f0-9]{64}$/.test(receipt.execution_admission_helper_sha256 || '')
+      || !/^[a-f0-9]{64}$/.test(receipt.execution_repository_identity_digest || '')
+      || !/^[a-f0-9]{64}$/.test(receipt.execution_preexisting_commits_digest || '')
+      || typeof receipt.terminal_id !== 'string' || !receipt.terminal_id) {
+      fail('INVALID_EXECUTION_ADMISSION', 'execution admission requires the pinned helper and exact repository baseline');
+    }
+  }
+
+  #launchReconciled(launchNonce) {
+    return this.#records.some((record) => record.type === 'attempt_recovered'
+      && (record.payload?.reconciliation?.execution_admissions?.some((entry) =>
+        entry.status === 'not_started' && entry.launch_nonce === launchNonce)
+      || record.payload?.reconciliation?.execution_dispatches?.some((entry) =>
+        entry.status === 'interrupted_restored' && entry.launch_nonce === launchNonce)));
+  }
+
+  #restorationProof(dispatch, options = {}) {
+    return restoredExecutionProof(this.#records, dispatch, { ...options,
+      verifyAuthority: (kind, receipt, expected, context) => this.#verifyAuthority(kind, receipt, expected, context) });
+  }
+
+  #assertCompletionNotRestored(dispatch) {
+    if (this.#records.some((record) => ['execution_checkpoint_preserved', 'execution_worktree_restored'].includes(record.type)
+      && record.payload.dispatch_event_id === dispatch.event_id)) {
+      fail('EXECUTION_COMPLETION_AFTER_CHECKPOINT', 'checkpointed interruption cannot be replaced by a late completion');
+    }
+  }
+
+  #assertAdmissionDispatchBound(reservation, receipt) {
+    const admission = reservation.payload.admission_receipt;
+    if (receipt.process_containment_kind === 'darwin_scoped_process_group_v1' && !admission) {
+      fail('EXECUTION_ADMISSION_DISPATCH_MISMATCH', 'Darwin dispatch requires its canonical pre-execution admission, not only a digest label');
+    }
+    if (receipt.process_containment_kind === 'darwin_scoped_process_group_v1' && admission) {
+      assertDarwinHostBootIdentity(admission.darwin_host_boot_identity);
+      if (sha256(receipt.darwin_launch_binding.host_boot_identity) !== sha256(admission.darwin_host_boot_identity)) {
+        fail('EXECUTION_ADMISSION_DISPATCH_MISMATCH', 'Darwin dispatch must bind its admission host and boot');
+      }
+    }
+    if (admission && (receipt.execution_admission_receipt_digest !== sha256(admission)
+      || receipt.execution_admission_protocol !== admission.execution_admission_protocol
+      || receipt.execution_admission_helper_sha256 !== admission.execution_admission_helper_sha256
+      || receipt.terminal_id !== admission.terminal_id)) {
+      fail('EXECUTION_ADMISSION_DISPATCH_MISMATCH', 'dispatch does not bind its exact canonical pre-execution admission');
+    }
+  }
+
   #assertDirectoryStable() {
     if (!this.#activeDirectory) fail('UNSAFE_JOURNAL_DIRECTORY', 'journal mutation requires a pinned parent directory');
     let canonical;
@@ -683,10 +838,16 @@ export class RailEngine {
     if (!this.#activeDirectory) {
       fail('UNSAFE_JOURNAL_DIRECTORY', 'journal parent changed during mutation');
     }
-    return join(this.#activeDirectory.reference, basename(path));
+    return basename(path);
   }
 
   #exclusive(action) {
+    // Capture before creating a lock: a failed native observation must not leave
+    // a newly created ownerless lock behind.
+    const hostBootIdentity = process.platform === 'darwin' ? captureDarwinHostBootIdentity() : null;
+    // Skip on Darwin: its identity above is already authoritative, and capturing
+    // a marker there would cost a second native host observation for nothing.
+    const hostBootMarker = hostBootIdentity ? null : captureHostBootMarker();
     const directory = openDirectoryForSync(dirname(this.#journalPath), { create: true });
     this.#activeDirectory = directory;
     const path = this.#activeEntry(lockPath(this.#journalPath));
@@ -695,9 +856,11 @@ export class RailEngine {
     try {
       for (let retry = 0; retry < LOCK_RETRIES; retry += 1) {
         try {
-          descriptor = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+          descriptor = openAtSync(directory.fd, path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
           lockToken = `${process.pid}-${Date.now()}-${randomUUID()}`;
-          const ownerBytes = Buffer.from(JSON.stringify({ schema_version: 1, pid: process.pid, hostname: hostname(), token: lockToken, acquired_at: new Date().toISOString() }));
+          const ownerBytes = Buffer.from(JSON.stringify({ schema_version: 1, pid: process.pid, hostname: hostname(), token: lockToken,
+            acquired_at: new Date().toISOString(), ...(hostBootIdentity ? { darwin_host_boot_identity: hostBootIdentity } : {}),
+            ...(hostBootMarker ? { host_boot_marker: hostBootMarker } : {}) }));
           writeSync(descriptor, ownerBytes, 0, ownerBytes.length);
           fsyncSync(descriptor);
           fsyncSync(directory.fd);
@@ -705,7 +868,7 @@ export class RailEngine {
         } catch (error) {
           if (descriptor !== undefined) { closeSync(descriptor); descriptor = undefined; }
           if (error?.code !== 'EEXIST') throw error;
-          if (recoverStaleLock(path)) continue;
+          if (recoverStaleLock(directory, path, hostBootIdentity)) continue;
           Atomics.wait(LOCK_WAIT, 0, 0, 2);
         }
       }
@@ -717,7 +880,7 @@ export class RailEngine {
     } finally {
       if (descriptor !== undefined) {
         closeSync(descriptor);
-        if (readLockOwner(path)?.token === lockToken) { unlinkSync(path); fsyncSync(directory.fd); }
+        if (readLockOwner(directory, path)?.token === lockToken) { unlinkAtSync(directory.fd, path); fsyncSync(directory.fd); }
       }
       this.#activeDirectory = undefined;
       closeSync(directory.fd);
@@ -734,7 +897,7 @@ export class RailEngine {
     const temporary = `${target}.${process.pid}.${randomUUID()}.tmp`;
     let fd;
     try {
-      fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+      fd = openAtSync(this.#activeDirectory.fd, temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
       const bytes = Buffer.from(JSON.stringify(checkpoint));
       if (bytes.length > JOURNAL_RECORD_MAX_BYTES) fail('JOURNAL_SIZE_LIMIT', 'journal checkpoint exceeds the record safety limit');
       writeSync(fd, bytes, 0, bytes.length);
@@ -742,11 +905,11 @@ export class RailEngine {
       closeSync(fd);
       fd = undefined;
       this.#assertDirectoryStable();
-      renameSync(temporary, target);
+      renameAtSync(this.#activeDirectory.fd, temporary, this.#activeDirectory.fd, target);
       fsyncSync(this.#activeDirectory.fd);
     } finally {
       if (fd !== undefined) closeSync(fd);
-      try { if (existsSync(temporary)) unlinkSync(temporary); } catch { /* preserve primary failure */ }
+      try { unlinkAtSync(this.#activeDirectory.fd, temporary); } catch { /* preserve primary failure */ }
     }
   }
 
@@ -803,7 +966,7 @@ export class RailEngine {
     const existed = this.#journalIdentity !== null;
     let fd;
     try {
-      fd = openSync(this.#activeEntry(this.#journalPath), constants.O_WRONLY | constants.O_APPEND
+      fd = openAtSync(this.#activeDirectory.fd, this.#activeEntry(this.#journalPath), constants.O_WRONLY | constants.O_APPEND
         | (existed ? 0 : constants.O_CREAT | constants.O_EXCL)
         | (constants.O_NOFOLLOW || 0), 0o600);
     } catch (error) {
@@ -931,6 +1094,7 @@ export class RailEngine {
 
   reserveExecutionLaunch({
     attempt_id, claim_id, operator_id, harness_process_id, invocation,
+    admission_receipt = null, project_dir = null,
   } = {}) {
     return this.#exclusive(() => {
       for (const [field, value] of Object.entries({
@@ -940,6 +1104,7 @@ export class RailEngine {
       assertString(invocation.invocation_id, 'INVALID_EXECUTION_LAUNCH_RESERVATION', 'invocation.invocation_id');
       assertString(invocation.launch_nonce, 'INVALID_EXECUTION_LAUNCH_RESERVATION', 'invocation.launch_nonce');
       assertString(invocation.prompt_digest, 'INVALID_EXECUTION_LAUNCH_RESERVATION', 'invocation.prompt_digest');
+      if (this.#launchReconciled(invocation.launch_nonce)) fail('EXECUTION_LAUNCH_ALREADY_RECONCILED', 'reconciled launch nonce may not be reused');
       const attempt = this.#attempts().get(attempt_id);
       if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) {
         fail('ATTEMPT_NOT_ACTIVE', 'execution launch reservation requires an active attempt', { attempt_id });
@@ -963,17 +1128,22 @@ export class RailEngine {
         || invocation.model_pin?.reasoning_configuration !== binding.reasoning_configuration) {
         fail('EXECUTION_BINDING_MISMATCH', 'execution launch reservation does not match the sealed task binding');
       }
+      if (admission_receipt !== null) this.#verifyExecutionAdmission({
+        attempt, invocation, receipt: admission_receipt, project_dir, harness_process_id,
+      });
       const existing = this.#records.find((record) => record.type === 'execution_launch_reserved'
         && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
       if (existing) {
         if (sha256(existing.payload.invocation) !== sha256(invocation)
-          || existing.payload.claim_event_id !== attempt.claim_event_id) {
+          || existing.payload.claim_event_id !== attempt.claim_event_id
+          || sha256(existing.payload.admission_receipt ?? null) !== sha256(admission_receipt)) {
           fail('EXECUTION_LAUNCH_NONCE_CONFLICT', 'launch nonce is already reserved for different execution material');
         }
         return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
       }
       const unresolvedReservation = this.#records.find((record) => record.type === 'execution_launch_reserved'
         && record.payload?.attempt_id === attempt_id
+        && !this.#launchReconciled(record.payload.invocation.launch_nonce)
         && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
           && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
       if (unresolvedReservation) {
@@ -982,6 +1152,7 @@ export class RailEngine {
       const unresolvedDispatch = this.#records.find((record) => record.type === 'execution_dispatched'
         && record.payload?.attempt_id === attempt_id
         && record.payload?.run_kind === 'initial'
+        && !this.#launchReconciled(record.payload.invocation.launch_nonce)
         && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
           && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
       if (unresolvedDispatch) {
@@ -990,6 +1161,7 @@ export class RailEngine {
       const payload = canonicalize({
         attempt_id, claim_id, operator_id, harness_process_id,
         claim_event_id: attempt.claim_event_id, invocation,
+        ...(admission_receipt ? { admission_receipt } : {}),
         reserved_at: timestamp(this.#clock),
       });
       const record = this.#append('execution_launch_reserved', payload, attempt.claim_event_id);
@@ -1008,6 +1180,7 @@ export class RailEngine {
       assertObject(invocation, 'INVALID_EXECUTION_DISPATCH', 'invocation');
       assertObject(launch_receipt, 'INVALID_EXECUTION_DISPATCH', 'launch_receipt');
       assertString(invocation.launch_nonce, 'INVALID_EXECUTION_DISPATCH', 'invocation.launch_nonce');
+      if (this.#launchReconciled(invocation.launch_nonce)) fail('EXECUTION_LAUNCH_ALREADY_RECONCILED', 'reconciled launch nonce may not dispatch');
       assertString(invocation.prompt_digest, 'INVALID_EXECUTION_DISPATCH', 'invocation.prompt_digest');
       assertString(project_dir, 'INVALID_EXECUTION_DISPATCH', 'project_dir');
       if (browser_manifest !== null) assertObject(browser_manifest, 'INVALID_EXECUTION_DISPATCH', 'browser_manifest');
@@ -1065,10 +1238,12 @@ export class RailEngine {
           || sha256(launchReservation.payload.invocation) !== sha256(invocation)) {
           fail('RAIL_REWORK_LAUNCH_RESERVATION_REQUIRED', 'rework dispatch requires its exact canonical pre-launch intent');
         }
+        this.#assertAdmissionDispatchBound(launchReservation, launch_receipt);
         const priorDispatches = this.#records.filter((record) => record.type === 'execution_dispatched'
           && record.payload?.attempt_id === attempt_id
           && record.payload?.invocation?.rework_reservation_id === rework_reservation_id);
-        const unreceipted = priorDispatches.find((dispatch) => !this.#records.some((record) => record.type === 'execution_recorded'
+        const unreceipted = priorDispatches.find((dispatch) => !this.#launchReconciled(dispatch.payload.invocation.launch_nonce)
+          && !this.#records.some((record) => record.type === 'execution_recorded'
           && record.payload?.execution_evidence?.receipt_nonce === dispatch.payload.invocation.launch_nonce));
         if (unreceipted) {
           fail('RAIL_REWORK_DISPATCH_UNRESOLVED', 'a prior launch in this rework reservation has no canonical completion evidence');
@@ -1085,7 +1260,8 @@ export class RailEngine {
         fail('EXECUTION_BINDING_MISMATCH', 'execution dispatch does not match the sealed task provider, harness, model and reasoning binding');
       }
       const expectedExecutionBase = this.#executionEvidence(attempt_id, { successfulOnly: true })
-        .at(-1)?.result_commit_ref ?? attempt.git_commit_ref;
+        .at(-1)?.result_commit_ref ?? attemptExecutionBase(attempt);
+      assertTerminalLaunchContainment(launch_receipt, 'EXECUTION_LAUNCH_RECEIPT_MISMATCH');
       if (launch_receipt.purpose !== 'terminal_launch'
         || launch_receipt.authority_kind !== 'rail_execution'
         || launch_receipt.invocation_id !== invocation.invocation_id
@@ -1107,12 +1283,18 @@ export class RailEngine {
         || typeof launch_receipt.process_hostname !== 'string' || !launch_receipt.process_hostname
         || !(launch_receipt.process_group_id === null
           || (Number.isInteger(launch_receipt.process_group_id) && launch_receipt.process_group_id > 0))
-        || launch_receipt.process_containment_kind !== 'bubblewrap_pid_namespace_v1'
         || typeof launch_receipt.process_containment_id !== 'string' || !launch_receipt.process_containment_id
         || !/^[a-f0-9]{64}$/.test(launch_receipt.process_containment_digest || '')
         || typeof launch_receipt.authority_signature !== 'string') {
         fail('EXECUTION_LAUNCH_RECEIPT_MISMATCH', 'launch receipt does not echo the exact canonical invocation');
       }
+      if (launch_receipt.process_namespace_identity !== undefined) {
+        assertLinuxNamespaceIdentity(launch_receipt.process_namespace_identity);
+        if (launch_receipt.process_namespace_identity.hostname !== launch_receipt.process_hostname
+          || launch_receipt.process_namespace_identity.pid === launch_receipt.process_pid) {
+          fail('EXECUTION_LAUNCH_RECEIPT_MISMATCH', 'namespace init identity must bind the exact host and differ from the outer monitor');
+        }
+      }
       const existing = this.#records.find((record) => record.type === 'execution_dispatched'
         && record.payload?.invocation?.launch_nonce === invocation.launch_nonce);
       if (existing) {
@@ -1134,9 +1316,11 @@ export class RailEngine {
           || sha256(reservation.payload.invocation) !== sha256(invocation)) {
           fail('RAIL_EXECUTION_LAUNCH_RESERVATION_REQUIRED', 'initial execution dispatch requires its exact canonical pre-launch reservation');
         }
+        this.#assertAdmissionDispatchBound(reservation, launch_receipt);
         const unresolved = this.#records.find((record) => record.type === 'execution_dispatched'
           && record.payload?.attempt_id === attempt_id
           && record.payload?.run_kind === 'initial'
+          && !this.#launchReconciled(record.payload.invocation.launch_nonce)
           && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
             && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
         if (unresolved) {
@@ -1153,12 +1337,345 @@ export class RailEngine {
     });
   }
 
-  recordExecutionEvidence({
+  recordHumanEffortObservation({ attempt_id, receipt } = {}) {
+    return this.#exclusive(() => {
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt) fail('RAIL_ATTEMPT_NOT_FOUND', 'human effort requires a canonical attempt');
+      this.#verifyAuthority('human_effort', receipt, { purpose: 'rail_human_effort', attempt_id,
+        handoff_id: attempt.handoff_id, task_id: attempt.task_id });
+      if (!['opened', 'finished', 'interrupted'].includes(receipt.phase)) fail('INVALID_HUMAN_EFFORT', 'invalid human effort phase');
+      const entries = this.#records.filter((record) => record.type === 'human_effort_observed'
+        && record.payload.receipt.session_id === receipt.session_id);
+      const existing = entries.find((record) => (record.payload.receipt.phase === 'opened') === (receipt.phase === 'opened'));
+      if (existing) {
+        if (sha256(existing.payload.receipt) !== sha256(receipt)) fail('HUMAN_EFFORT_CONFLICT', 'human effort observation is immutable');
+        return Object.freeze({ ...existing.payload, event_id: existing.event_id, replay: true });
+      }
+      if (receipt.phase === 'opened') {
+        if (!['active', 'ready_to_merge'].includes(attempt.state)
+          || receipt.claim_id !== attempt.claim.claim_id || receipt.operator_id !== attempt.claim.operator_id) {
+          fail('HUMAN_EFFORT_CLAIM_MISMATCH', 'new human effort session must bind the current attempt claim');
+        }
+      } else {
+        const opened = entries.find((record) => record.payload.receipt.phase === 'opened')?.payload.receipt;
+        if (!opened || receipt.opened_receipt_digest !== sha256(opened)
+          || ['operator_id', 'claim_id', 'account', 'project_binding'].some((key) => sha256(receipt[key]) !== sha256(opened[key]))) {
+          fail('HUMAN_EFFORT_SESSION_MISMATCH', 'human effort result must bind its exact opened session');
+        }
+      }
+      const record = this.#append('human_effort_observed', { attempt_id, receipt });
+      return Object.freeze({ ...record.payload, event_id: record.event_id, replay: false });
+    });
+  }
+
+  humanEffortForAttempt(attempt_id) {
+    return this.#exclusive(() => {
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt) fail('RAIL_ATTEMPT_NOT_FOUND', 'human effort requires a canonical attempt');
+      const entries = this.#records.filter((record) => record.type === 'human_effort_observed' && record.payload.attempt_id === attempt_id);
+      const opened = entries.filter((record) => record.payload.receipt.phase === 'opened');
+      if (!opened.length) fail('HUMAN_EFFORT_REQUIRED', 'human effort is unknown until the operator explicitly declares timed or zero effort');
+      const sessions = opened.flatMap((record, index) => {
+        const start = record.payload.receipt;
+        const endings = entries.filter((entry) => entry.payload.receipt.session_id === start.session_id && entry.payload.receipt.phase !== 'opened');
+        const isMostRecentOpened = index === opened.length - 1;
+        if (endings.length !== 1 || endings[0].payload.receipt.phase !== 'finished') {
+          // A session superseded by a later opened session is only excused when it
+          // was explicitly marked interrupted (the operator's terminal dropped); an
+          // ending-less session, or the latest session itself, never qualifies.
+          const supersededInterruption = !isMostRecentOpened && endings.length === 1 && endings[0].payload.receipt.phase === 'interrupted';
+          if (!supersededInterruption) {
+            fail('HUMAN_EFFORT_INCOMPLETE', 'interrupted or unfinished human effort cannot be inferred from wall-clock timestamps');
+          }
+          return [];
+        }
+        const finish = endings[0].payload.receipt;
+        const binding = { purpose: 'rail_human_effort', attempt_id, handoff_id: attempt.handoff_id, task_id: attempt.task_id };
+        this.#verifyAuthority('human_effort', start, binding);
+        this.#verifyAuthority('human_effort', finish, { ...binding, opened_receipt_digest: sha256(start),
+          operator_id: start.operator_id, claim_id: start.claim_id, account: start.account, project_binding: start.project_binding });
+        return [{ session_id: start.session_id, operator_id: start.operator_id, account: start.account,
+          declaration: finish.declaration, value: finish.value,
+          source_event_ids: [record.event_id, endings[0].event_id], receipt_digest: sha256(finish) }];
+      });
+      const value = sessions.reduce((total, session) => total + session.value, 0);
+      if (!Number.isFinite(value)) fail('INVALID_HUMAN_EFFORT', 'human effort exceeds the finite measurement range');
+      return Object.freeze(canonicalize({ schema_version: 1, evidence_class: 'operator-declared-timed-effort',
+        attempt_id, unit: 'milliseconds', value, sessions }));
+    });
+  }
+
+  /** Records observation only, even after lease loss; grants no retry or recovery authority. */
+  recordProviderProcessObservation({ attempt_id, terminal_authority_receipt, terminal_output } = {}) {
+    return this.#exclusive(() => {
+      assertString(attempt_id, 'INVALID_PROCESS_OBSERVATION', 'attempt_id');
+      assertObject(terminal_authority_receipt, 'INVALID_PROCESS_OBSERVATION', 'terminal_authority_receipt');
+      const dispatches = providerProcessDispatches(this.#records, attempt_id).filter((record) =>
+        record.payload.invocation.launch_nonce === terminal_authority_receipt.launch_nonce);
+      if (dispatches.length !== 1) fail('RAIL_PROCESS_DISPATCH_REQUIRED', 'process observation requires one exact canonical dispatch');
+      const dispatch = dispatches[0];
+      this.#assertCompletionNotRestored(dispatch);
+      assertProviderProcessReceipt(dispatch, terminal_authority_receipt, (kind, receipt, expected) => this.#verifyAuthority(kind, receipt, expected));
+      if (terminal_output !== undefined) assertProviderProcessOutput(terminal_output, terminal_authority_receipt);
+      const existing = this.#records.find((record) => record.type === 'provider_process_observed'
+        && record.payload.attempt_id === attempt_id && record.payload.dispatch_event_id === dispatch.event_id);
+      if (existing) {
+        if (sha256(existing.payload.terminal_authority_receipt) !== sha256(terminal_authority_receipt)) {
+          fail('RAIL_PROCESS_RECEIPT_CONFLICT', 'observed completion receipt is immutable');
+        }
+        if (terminal_output !== undefined && sha256(existing.payload.terminal_output ?? null) !== sha256(terminal_output)) {
+          fail('RAIL_PROCESS_OUTPUT_CONFLICT', 'observed output is immutable; a legacy receipt-only record cannot be retroactively upgraded');
+        }
+        return Object.freeze({ ...existing.payload, event_id: existing.event_id, replay: true });
+      }
+      const payload = { attempt_id, dispatch_event_id: dispatch.event_id,
+        invocation_id: dispatch.payload.invocation.invocation_id, launch_nonce: dispatch.payload.invocation.launch_nonce,
+        terminal_authority_receipt, ...(terminal_output === undefined ? {} : { terminal_output }) };
+      const record = this.#append('provider_process_observed', payload);
+      return Object.freeze({ ...record.payload, event_id: record.event_id, replay: false });
+    });
+  }
+
+  providerProcessingForAttempt(attempt_id) {
+    return this.#exclusive(() => {
+      assertString(attempt_id, 'INVALID_PROCESS_OBSERVATION', 'attempt_id');
+      if (!this.#attempts().has(attempt_id)) fail('RAIL_ATTEMPT_NOT_FOUND', 'processing evidence requires a canonical attempt');
+      return collectProviderProcessing(this.#records, { attempt_id,
+        verifyAuthority: (kind, receipt, expected, context) => this.#verifyAuthority(kind, receipt, expected, context) });
+    });
+  }
+
+  /** Observe only canonical interrupted dispatches, never caller-owned PIDs. */
+  observeInterruptedExecution({ attempt_id, launch_nonce, git_dir, expected_attempt_event_id, termination_attestation } = {}) {
+    return this.#exclusive(() => {
+      this.#assertAttemptRevision(attempt_id, expected_attempt_event_id);
+      for (const [field, value] of Object.entries({ attempt_id, launch_nonce, git_dir })) {
+        assertString(value, 'INVALID_EXECUTION_RECONCILIATION', field);
+      }
+      const dispatch = this.#records.find((record) => record.type === 'execution_dispatched'
+        && record.payload.attempt_id === attempt_id && record.payload.invocation.launch_nonce === launch_nonce);
+      if (!dispatch) fail('RECOVERY_EXECUTION_DISPATCH_REQUIRED', 'interruption requires an existing canonical execution dispatch');
+      const { invocation, launch_receipt: launch } = dispatch.payload;
+      this.#verifyAuthority('execution_launch', launch, {
+        purpose: 'terminal_launch', authority_kind: 'rail_execution',
+        invocation_id: invocation.invocation_id, launch_nonce, working_dir: resolve(git_dir),
+        provider_id: invocation.provider_id, harness_id: invocation.harness_id,
+        model_id: invocation.model_pin.model_id, reasoning_configuration: invocation.model_pin.reasoning_configuration,
+        prompt_digest: invocation.prompt_digest,
+      });
+      if (this.#records.some((record) => (record.type === 'execution_recorded'
+        && record.payload?.execution_evidence?.receipt_nonce === launch_nonce)
+        || (record.type === 'provider_process_observed' && record.payload.dispatch_event_id === dispatch.event_id))) {
+        fail('RECOVERY_EXECUTION_ALREADY_OBSERVED', 'canonical completion material must not be downgraded to an unknown interruption');
+      }
+      const existing = this.#records.find((record) => record.type === 'execution_interruption_observed'
+        && record.payload.dispatch_event_id === dispatch.event_id);
+      if (existing) {
+        assertExecutionInterruptionLifetime(dispatch, existing);
+        return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
+      }
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'interruption observation requires an active attempt');
+      if (!isExpired(attempt.claim, timestamp(this.#clock))) fail('LEASE_STILL_ACTIVE', 'interruption observation cannot race a live lease');
+      observeStoppedClaimProcess(attempt);
+      const reservation = this.#records.find((record) => ['execution_launch_reserved', 'rework_launch_reserved'].includes(record.type)
+        && record.payload.attempt_id === attempt_id && record.payload.invocation.launch_nonce === launch_nonce);
+      if (!reservation || reservation.payload.claim_event_id !== attempt.claim_event_id
+        || reservation.payload.harness_process_id !== attempt.claim.harness_process_id
+        || dispatch.payload.claim_id !== attempt.claim.claim_id
+        || dispatch.payload.operator_id !== attempt.claim.operator_id
+        || sha256(reservation.payload.invocation) !== sha256(invocation)) {
+        fail('RECOVERY_ADMISSION_CLAIM_MISMATCH', 'interrupted dispatch must belong to the current stopped supervisor generation');
+      }
+      this.#verifyExecutionAdmission({ attempt, invocation, receipt: reservation.payload.admission_receipt,
+        project_dir: git_dir, harness_process_id: attempt.claim.harness_process_id });
+      this.#assertAdmissionDispatchBound(reservation, launch);
+      const unresolved = [...this.#effects().values()].filter((effect) => effect.attempt_id === attempt_id && !effect.receipt_ref);
+      if (unresolved.length) fail('RECOVERY_EFFECTS_UNRESOLVED', 'unreceipted effects require external reconciliation before interruption recovery', {
+        idempotency_keys: unresolved.map((effect) => effect.idempotency_key),
+      });
+      let processObservation;
+      let lifetimeBinding;
+      if (launch.process_containment_kind === 'darwin_scoped_process_group_v1') {
+        assertTerminalLaunchContainment(launch, 'RECOVERY_DARWIN_LIFETIME_UNPROVEN');
+        try { processObservation = observeDarwinPreviousBoot(launch.darwin_launch_binding.host_boot_identity); }
+        catch (error) {
+          // A same-boot crash has no new-boot proof; an explicit human attestation
+          // that no launch processes remain is only ever consulted here, after the
+          // stronger reboot proof has already failed.
+          if (termination_attestation === undefined) fail('RECOVERY_DARWIN_LIFETIME_UNPROVEN', error.message, { cause_code: error.code });
+          if (!isWellFormedTerminationAttestation(termination_attestation)) {
+            fail('RECOVERY_ATTESTATION_INVALID', 'termination attestation must declare exactly operator_id, attested_at and the no-launch-processes-remain statement');
+          }
+          if (termination_attestation.operator_id !== attempt.claim.operator_id) {
+            fail('RECOVERY_ATTESTATION_OPERATOR_MISMATCH', 'termination attestation must be signed by the current claim operator');
+          }
+          processObservation = Object.freeze({ status: 'exited', reason: 'human-attested', signal_sent: false,
+            host_boot_identity: captureDarwinHostBootIdentity(), attestation: termination_attestation });
+        }
+        lifetimeBinding = { darwin_host_boot_identity_digest: sha256(launch.darwin_launch_binding.host_boot_identity) };
+      } else {
+        if (termination_attestation !== undefined) {
+          fail('RECOVERY_ATTESTATION_UNSUPPORTED', 'termination attestation is only supported for Darwin scoped process group launches');
+        }
+        if (!launch.process_namespace_identity) fail('RECOVERY_NAMESPACE_IDENTITY_REQUIRED', 'legacy dispatch has no authenticated namespace identity');
+        assertLinuxNamespaceIdentity(launch.process_namespace_identity);
+        // Authentication, claim/lease and effect checks precede any signal.
+        // Linux matches a pidfd; Darwin's new-boot proof never signals a PID.
+        processObservation = observeLinuxNamespace(launch.process_namespace_identity, { terminate: true, timeoutMs: 1000 });
+        lifetimeBinding = { process_namespace_identity_digest: sha256(launch.process_namespace_identity) };
+      }
+      if (processObservation.status !== 'exited') fail('RECOVERY_NAMESPACE_STILL_RUNNING', 'namespace termination is not yet observed');
+      const record = this.#append('execution_interruption_observed', {
+        attempt_id, dispatch_event_id: dispatch.event_id, launch_nonce,
+        launch_receipt_digest: sha256(launch), ...lifetimeBinding,
+        status: 'interrupted', process: processObservation,
+        exit_status: null, process_elapsed_ms: null, result_commit_ref: null, output_status: 'unavailable',
+        // Process absence is not a checkpoint and must not consume the nonce.
+        next_required_action: 'preserve_worktree_checkpoint',
+      }, dispatch.event_id);
+      return Object.freeze(canonicalize({ ...record.payload, event_id: record.event_id, replay: false }));
+    });
+  }
+
+  #interruptedExecutionContext({ attempt_id, launch_nonce, git_dir, expected_attempt_event_id }) {
+      this.#assertAttemptRevision(attempt_id, expected_attempt_event_id);
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'checkpoint requires an active interrupted attempt');
+      if (!isExpired(attempt.claim, timestamp(this.#clock))) fail('LEASE_STILL_ACTIVE', 'checkpoint cannot race a live lease');
+      observeStoppedClaimProcess(attempt);
+      const dispatch = this.#records.find((record) => record.type === 'execution_dispatched'
+        && record.payload.attempt_id === attempt_id && record.payload.invocation.launch_nonce === launch_nonce);
+      const interruption = this.#records.find((record) => record.type === 'execution_interruption_observed'
+        && record.payload.dispatch_event_id === dispatch?.event_id);
+      if (!dispatch || !interruption) fail('RECOVERY_INTERRUPTION_OBSERVATION_REQUIRED', 'checkpoint requires a canonical observed interruption');
+      assertExecutionInterruptionLifetime(dispatch, interruption);
+      if (this.#records.some((record) => (record.type === 'execution_recorded'
+        && record.payload?.execution_evidence?.receipt_nonce === launch_nonce)
+        || (record.type === 'provider_process_observed' && record.payload.dispatch_event_id === dispatch.event_id))) {
+        fail('RECOVERY_EXECUTION_ALREADY_OBSERVED', 'observed completion cannot be replaced by restoration');
+      }
+      const reservation = this.#records.find((record) => ['execution_launch_reserved', 'rework_launch_reserved'].includes(record.type)
+        && record.payload.attempt_id === attempt_id && record.payload.invocation.launch_nonce === launch_nonce);
+      if (!reservation || reservation.payload.claim_event_id !== attempt.claim_event_id
+        || reservation.payload.harness_process_id !== attempt.claim.harness_process_id
+        || dispatch.payload.claim_id !== attempt.claim.claim_id || dispatch.payload.operator_id !== attempt.claim.operator_id
+        || sha256(reservation.payload.invocation) !== sha256(dispatch.payload.invocation)) {
+        fail('RECOVERY_ADMISSION_CLAIM_MISMATCH', 'checkpoint belongs to another claim generation');
+      }
+      this.#verifyExecutionAdmission({ attempt, invocation: dispatch.payload.invocation,
+        receipt: reservation.payload.admission_receipt, project_dir: git_dir, harness_process_id: attempt.claim.harness_process_id });
+      this.#assertAdmissionDispatchBound(reservation, dispatch.payload.launch_receipt);
+      const unresolved = [...this.#effects().values()].filter((effect) => effect.attempt_id === attempt_id && !effect.receipt_ref);
+      if (unresolved.length) fail('RECOVERY_EFFECTS_UNRESOLVED', 'checkpoint recovery requires external effect reconciliation');
+      return { dispatch, interruption, binding: executionCheckpointBinding(dispatch, interruption) };
+  }
+
+  /** Preserve observed partial work, without restoring Git or recovering a claim. */
+  preserveInterruptedExecution({ attempt_id, launch_nonce, git_dir, expected_attempt_event_id } = {}) {
+    return this.#exclusive(() => {
+      const { dispatch, interruption, binding } = this.#interruptedExecutionContext({ attempt_id, launch_nonce, git_dir, expected_attempt_event_id });
+      const existing = this.#records.find((record) => record.type === 'execution_checkpoint_preserved'
+        && record.payload.dispatch_event_id === dispatch.event_id);
+      let receipt = existing?.payload.checkpoint_receipt;
+      if (!receipt) {
+        if (!this.#checkpointWriter) fail('RECOVERY_CHECKPOINT_WRITER_REQUIRED', 'checkpoint requires the configured protected host adapter');
+        receipt = this.#checkpointWriter({ projectDir: git_dir, dispatch, interruption });
+      }
+      this.#verifyAuthority('execution_checkpoint', receipt, { schema_version: 1, purpose: 'rail_execution_checkpoint',
+        project_dir: resolve(git_dir), binding });
+      if (existing) return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
+      const record = this.#append('execution_checkpoint_preserved', { attempt_id, dispatch_event_id: dispatch.event_id,
+        launch_nonce, checkpoint_receipt: receipt, next_required_action: 'restore_checkpointed_execution_base' }, interruption.event_id);
+      return Object.freeze(canonicalize({ ...record.payload, event_id: record.event_id, replay: false }));
+    });
+  }
+
+  /** Restore only a canonical checkpoint under the same journal exclusion. The
+   * nonce remains pending until recoverAttempt verifies current storage. */
+  restoreInterruptedExecution({ attempt_id, launch_nonce, git_dir, expected_attempt_event_id } = {}) {
+    return this.#exclusive(() => {
+      const { dispatch, binding } = this.#interruptedExecutionContext({ attempt_id, launch_nonce, git_dir, expected_attempt_event_id });
+      const checkpoint = this.#records.find((record) => record.type === 'execution_checkpoint_preserved'
+        && record.payload.dispatch_event_id === dispatch.event_id);
+      if (!checkpoint) fail('RECOVERY_CHECKPOINT_REQUIRED', 'restore requires a canonical preserved checkpoint');
+      this.#verifyAuthority('execution_checkpoint', checkpoint.payload.checkpoint_receipt, {
+        schema_version: 1, purpose: 'rail_execution_checkpoint', project_dir: resolve(git_dir), binding });
+      const existing = this.#records.find((record) => record.type === 'execution_worktree_restored'
+        && record.payload.dispatch_event_id === dispatch.event_id);
+      if (existing) {
+        this.#restorationProof(dispatch, { current: true });
+        return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
+      }
+      if (!this.#restorationWriter) fail('RECOVERY_RESTORATION_WRITER_REQUIRED', 'restore requires the configured protected host adapter');
+      const receipt = this.#restorationWriter({ projectDir: git_dir, receipt: checkpoint.payload.checkpoint_receipt });
+      this.#verifyAuthority('execution_restoration', receipt, { schema_version: 1, purpose: 'rail_execution_restoration',
+        project_dir: resolve(git_dir), binding, checkpoint_receipt_digest: sha256(checkpoint.payload.checkpoint_receipt),
+        restored_base_commit_ref: binding.base_commit_ref }, { checkpoint_receipt: checkpoint.payload.checkpoint_receipt, current: true });
+      const record = this.#append('execution_worktree_restored', { attempt_id, dispatch_event_id: dispatch.event_id,
+        launch_nonce, checkpoint_event_id: checkpoint.event_id, restoration_receipt: receipt,
+        next_required_action: 'recover_claim_with_fresh_launch_nonce' }, checkpoint.event_id);
+      return Object.freeze(canonicalize({ ...record.payload, event_id: record.event_id, replay: false }));
+    });
+  }
+
+  /** Import facts from one durable observation, never launch or recover a claim. */
+  reconcileObservedExecution({ attempt_id, launch_nonce, git_dir, expected_attempt_event_id } = {}) {
+    return this.#exclusive(() => {
+      this.#assertAttemptRevision(attempt_id, expected_attempt_event_id);
+      for (const [field, value] of Object.entries({ attempt_id, launch_nonce, git_dir })) {
+        assertString(value, 'INVALID_EXECUTION_RECONCILIATION', field);
+      }
+      const existing = this.#records.find((record) => record.type === 'execution_recorded'
+        && record.payload.attempt_id === attempt_id && record.payload.execution_evidence.receipt_nonce === launch_nonce);
+      if (existing) return Object.freeze(canonicalize({ ...existing.payload.execution_evidence, event_id: existing.event_id, replay: true }));
+      const attempt = this.#attempts().get(attempt_id);
+      if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) fail('ATTEMPT_NOT_ACTIVE', 'completion reconciliation requires an active attempt');
+      if (!isExpired(attempt.claim, timestamp(this.#clock))) fail('LEASE_STILL_ACTIVE', 'completion reconciliation cannot race a live lease');
+      observeStoppedClaimProcess(attempt);
+      const dispatch = this.#records.find((record) => record.type === 'execution_dispatched'
+        && record.payload.attempt_id === attempt_id && record.payload.invocation.launch_nonce === launch_nonce);
+      const observation = this.#records.find((record) => record.type === 'provider_process_observed'
+        && record.payload.attempt_id === attempt_id && record.payload.dispatch_event_id === dispatch?.event_id);
+      if (!dispatch || !observation?.payload.terminal_output) {
+        fail('RECOVERY_EXECUTION_COMPLETION_UNAVAILABLE', 'reconciliation requires a complete canonical observation, not caller-supplied output');
+      }
+      if (dispatch.payload.launch_receipt.working_dir !== resolve(git_dir)) {
+        fail('EXECUTION_RECONCILIATION_PROJECT_MISMATCH', 'completion must be reconciled in its exact dispatched project');
+      }
+      const { terminal_authority_receipt: receipt, terminal_output: output } = observation.payload;
+      assertProviderProcessReceipt(dispatch, receipt, (kind, value, expected) => this.#verifyAuthority(kind, value, expected));
+      assertProviderProcessOutput(output, receipt);
+      const unresolvedEffects = [...this.#effects().values()].filter((effect) => effect.attempt_id === attempt_id && !effect.receipt_ref);
+      if (unresolvedEffects.length) fail('RECOVERY_EFFECTS_UNRESOLVED', 'unreceipted effects require actual external reconciliation', {
+        idempotency_keys: unresolvedEffects.map((effect) => effect.idempotency_key),
+      });
+      const { invocation, launch_receipt: launch, run_kind, source_decision_ref } = dispatch.payload;
+      const execution = { terminal_id: receipt.terminal_id, provider: invocation.harness_id,
+        model: invocation.model_pin.model_id, reasoning_configuration: invocation.model_pin.reasoning_configuration,
+        exit_status: receipt.exit_status, stdout: output.stdout, stderr: output.stderr,
+        ...(launch.started_at === undefined ? {} : { started_at: launch.started_at }),
+        terminal_authority_receipt: receipt };
+      return this.#recordExecutionEvidence({ attempt_id, claim_id: attempt.claim.claim_id,
+        operator_id: attempt.claim.operator_id, invocation, execution,
+        base_commit_ref: launch.execution_base_commit_ref,
+        result_commit_ref: receipt.exit_status === 0 && receipt.execution_result_status !== 'invalid_output'
+          ? receipt.result_commit_ref : null,
+        run_kind, source_decision_ref: source_decision_ref ?? null,
+        receipt_nonce: launch_nonce, git_dir,
+      }, observation.event_id);
+    });
+  }
+
+  recordExecutionEvidence(input = {}) {
+    return this.#exclusive(() => this.#recordExecutionEvidence(input));
+  }
+
+  #recordExecutionEvidence({
     attempt_id, claim_id, operator_id, invocation, execution, base_commit_ref,
     result_commit_ref = null, run_kind = 'initial', source_decision_ref = null,
     receipt_nonce, git_dir,
-  } = {}) {
-    return this.#exclusive(() => {
+  } = {}, observedCompletionEventId = null) {
       for (const [field, value] of Object.entries({ attempt_id, claim_id, operator_id, receipt_nonce, git_dir })) {
         assertString(value, 'INVALID_EXECUTION_EVIDENCE', field);
       }
@@ -1179,7 +1696,7 @@ export class RailEngine {
       if (attempt.claim.claim_id !== claim_id || attempt.claim.operator_id !== operator_id) {
         fail('CLAIM_OWNER_MISMATCH', 'execution evidence must be receipted by the active claim owner', { attempt_id });
       }
-      this.#assertLiveLease(attempt, timestamp(this.#clock));
+      if (observedCompletionEventId === null) this.#assertLiveLease(attempt, timestamp(this.#clock));
       if (invocation.attempt_id !== attempt_id) fail('EXECUTION_INVOCATION_MISMATCH', 'execution invocation is not bound to the active attempt');
       if (receipt_nonce !== invocation.launch_nonce) fail('EXECUTION_LAUNCH_NONCE_MISMATCH', 'execution evidence must echo the dispatched launch nonce');
       const dispatch = this.#records.find((record) => record.type === 'execution_dispatched'
@@ -1190,6 +1707,7 @@ export class RailEngine {
       if (!dispatch || sha256(dispatch.payload.invocation) !== sha256(invocation)) {
         fail('EXECUTION_DISPATCH_REQUIRED', 'execution evidence requires an exact canonical dispatch record');
       }
+      this.#assertCompletionNotRestored(dispatch);
       if (execution.terminal_id !== dispatch.payload.launch_receipt.terminal_id
         || execution.provider !== invocation.harness_id
         || execution.model !== invocation.model_pin?.model_id
@@ -1209,6 +1727,11 @@ export class RailEngine {
         || typeof execution.terminal_authority_receipt?.authority_signature !== 'string') {
         fail('EXECUTION_TERMINAL_AUTHORITY_MISMATCH', 'completion receipt does not bind the canonical launch and terminal result');
       }
+      if (dispatch.payload.launch_receipt.process_namespace_identity
+        && execution.terminal_authority_receipt.process_namespace_identity_digest !== sha256(dispatch.payload.launch_receipt.process_namespace_identity)) {
+        fail('EXECUTION_TERMINAL_AUTHORITY_MISMATCH', 'completion must bind the exact observed namespace identity');
+      }
+      assertTerminalCompletionContainment(execution.terminal_authority_receipt, dispatch.payload.launch_receipt, 'EXECUTION_TERMINAL_AUTHORITY_MISMATCH');
       const resultStatus = execution.terminal_authority_receipt.execution_result_status;
       const invalidOutput = execution.exit_status === 0 && resultStatus === 'invalid_output';
       let executionFailureCode = null;
@@ -1254,7 +1777,7 @@ export class RailEngine {
         fail('EXECUTION_LAUNCH_ALREADY_RECEIPTED', 'this canonical launch already has execution evidence');
       }
       const successful = this.#executionEvidence(attempt_id, { successfulOnly: true });
-      const expectedBase = successful.at(-1)?.result_commit_ref ?? attempt.git_commit_ref;
+      const expectedBase = successful.at(-1)?.result_commit_ref ?? attemptExecutionBase(attempt);
       if (base_commit_ref !== expectedBase) fail('EXECUTION_BASE_MISMATCH', 'execution base must equal the latest canonical successful result or sealed base');
       if (run_kind === 'rework') {
         assertString(source_decision_ref, 'INVALID_EXECUTION_EVIDENCE', 'source_decision_ref');
@@ -1315,9 +1838,8 @@ export class RailEngine {
         && record.payload?.execution_evidence?.evidence_id === evidence_id);
       if (existing) return Object.freeze(canonicalize({ ...existing.payload.execution_evidence, event_id: existing.event_id, replay: true }));
       const evidence = canonicalize({ ...core, evidence_id, digest: sha256(core) });
-      const record = this.#append('execution_recorded', { attempt_id, execution_evidence: evidence });
+      const record = this.#append('execution_recorded', { attempt_id, execution_evidence: evidence }, observedCompletionEventId);
       return Object.freeze(canonicalize({ ...evidence, event_id: record.event_id, replay: false }));
-    });
   }
 
   #currentClaimForTask(taskId) {
@@ -1328,10 +1850,37 @@ export class RailEngine {
     return undefined;
   }
 
-  #mergedTaskIdsForHandoff(handoffId) {
+  #mergedAttemptsForHandoff(handoff) {
     return [...this.#attempts().values()]
-      .filter((attempt) => attempt.handoff_id === handoffId && attempt.state === 'merged')
-      .map((attempt) => attempt.task_id);
+      .filter((attempt) => attempt.handoff_id === handoff.handoff_id
+        && attempt.manifest_digest === handoff.seal.manifest_digest && attempt.state === 'merged');
+  }
+
+  #executionBaseForClaim(handoff, mergedAttempts, git_dir) {
+    const mergedIds = new Set(mergedAttempts.map((attempt) => attempt.attempt_id));
+    const completions = this.#records.filter((record) => record.type === 'attempt_completed'
+      && record.payload.completion.state === 'merged'
+      && mergedIds.has(record.payload.completion.attempt_id));
+    const base = completions.at(-1)?.payload.completion.git.result_ref ?? handoff.seal.git_commit_ref;
+    // A live HEAD is not integration evidence. Only canonical merged results can
+    // advance the base, and all previous merged results must be contained in it.
+    for (const predecessor of [handoff.seal.git_commit_ref,
+      ...completions.map((record) => record.payload.completion.git.result_ref)]) {
+      if (predecessor === base) verifyLocalGitCommit({ git_dir, git_commit_ref: base });
+      else {
+        try {
+          verifyCommitDescendsFrom({ git_dir, base_commit_ref: predecessor, result_commit_ref: base });
+        } catch (error) {
+          fail('EXECUTION_BASE_NOT_INTEGRATED', 'canonical merged results do not form an integrated execution base', {
+            predecessor, execution_base_commit_ref: base, cause_code: error.code,
+          });
+        }
+      }
+    }
+    return {
+      execution_base_commit_ref: base,
+      execution_base_completion_refs: completions.map((record) => record.event_id),
+    };
   }
 
   #assertAcceptedReviews(attemptId, reviews) {
@@ -1359,8 +1908,10 @@ export class RailEngine {
       fail(code, 'task has an existing claim and cannot be taken over without recovery', { task_id, attempt_id: incumbent.attempt.attempt_id });
     }
     if (this.#attempts().has(attempt_id)) fail('ATTEMPT_ALREADY_EXISTS', 'attempt_id already exists in journal', { attempt_id });
-    const completed_task_ids = this.#mergedTaskIdsForHandoff(handoff.handoff_id);
-    const attempt = createAttemptBinding({ handoff, task_id, attempt_id, completed_task_ids, git_dir });
+    const mergedAttempts = this.#mergedAttemptsForHandoff(handoff);
+    const completed_task_ids = mergedAttempts.map((attempt) => attempt.task_id);
+    const binding = createAttemptBinding({ handoff, task_id, attempt_id, completed_task_ids, git_dir });
+    const attempt = canonicalize({ ...binding, ...this.#executionBaseForClaim(handoff, mergedAttempts, git_dir) });
     const acquired_at = timestamp(this.#clock);
     const claim = canonicalize({
       claim_id: `claim-${sha256({ attempt_id, acquired_at, operator_id, harness_process_id }).slice(0, 24)}`,
@@ -1370,6 +1921,7 @@ export class RailEngine {
       operator_id,
       harness_process_id,
       hostname: hostname(),
+      ...(process.platform === 'darwin' ? { darwin_host_boot_identity: captureDarwinHostBootIdentity() } : {}),
       lease: { acquired_at, expires_at: plusMs(acquired_at, lease_ttl_ms), heartbeat_at: acquired_at },
       idempotency_scope: `task:${task_id}:attempt:${attempt_id}`,
     });
@@ -1378,8 +1930,9 @@ export class RailEngine {
     });
   }
 
-  heartbeat({ attempt_id, claim_id, operator_id, harness_process_id, lease_ttl_ms = 300000 } = {}) {
+  heartbeat({ attempt_id, claim_id, operator_id, harness_process_id, lease_ttl_ms = 300000, expected_attempt_event_id } = {}) {
     return this.#exclusive(() => {
+    this.#assertAttemptRevision(attempt_id, expected_attempt_event_id);
     assertString(attempt_id, 'INVALID_HEARTBEAT', 'attempt_id');
     assertString(claim_id, 'INVALID_HEARTBEAT', 'claim_id');
     assertString(operator_id, 'INVALID_HEARTBEAT', 'operator_id');
@@ -1481,7 +2034,8 @@ export class RailEngine {
             && record.payload?.attempt_id === attempt_id
             && record.payload?.run_kind === 'rework'
             && record.payload?.rework_reservation_id === existing.payload.reservation_id);
-          const unresolvedLaunches = launches.filter((launch) => !dispatches.some((dispatch) =>
+          const unresolvedLaunches = launches.filter((launch) => !this.#launchReconciled(launch.payload.invocation.launch_nonce)
+            && !dispatches.some((dispatch) =>
             dispatch.payload?.invocation?.launch_nonce === launch.payload.invocation.launch_nonce));
           if (unresolvedLaunches.length > 0) {
             fail('RAIL_REWORK_LAUNCH_UNRESOLVED', 'the previous rework reservation has a launch intent without authenticated provider dispatch', {
@@ -1489,7 +2043,8 @@ export class RailEngine {
               launch_nonces: unresolvedLaunches.map((launch) => launch.payload.invocation.launch_nonce),
             });
           }
-          const unresolved = dispatches.filter((dispatch) => !this.#records.some((record) => record.type === 'execution_recorded'
+          const unresolved = dispatches.filter((dispatch) => !this.#launchReconciled(dispatch.payload.invocation.launch_nonce)
+            && !this.#records.some((record) => record.type === 'execution_recorded'
             && record.payload?.execution_evidence?.receipt_nonce === dispatch.payload.invocation.launch_nonce));
           if (unresolved.length > 0) {
             fail('RAIL_REWORK_DISPATCH_UNRESOLVED', 'the previous rework reservation has a dispatch without canonical execution evidence', {
@@ -1503,7 +2058,9 @@ export class RailEngine {
           this.#append('rework_reservation_released', canonicalize({
             attempt_id, claim_id, operator_id, harness_process_id,
             source_decision_ref, reservation_id: existing.payload.reservation_id,
-            reason: dispatches.length > 0 ? 'recovered_after_canonical_execution' : 'recovered_before_launch_intent',
+            reason: dispatches.some((dispatch) => this.#launchReconciled(dispatch.payload.invocation.launch_nonce))
+              ? 'recovered_after_checkpoint_restoration' : dispatches.length > 0 ? 'recovered_after_canonical_execution'
+              : launches.length > 0 ? 'recovered_after_not_started_admission' : 'recovered_before_launch_intent',
             reconciled_claim_event_id: existing.payload.claim_event_id,
           }), attempt.recovery_event_id);
         }
@@ -1520,6 +2077,7 @@ export class RailEngine {
   reserveReworkLaunch({
     attempt_id, claim_id, operator_id, harness_process_id,
     source_decision_ref, reservation_id, invocation,
+    admission_receipt = null, project_dir = null,
   } = {}) {
     return this.#exclusive(() => {
       for (const [field, value] of Object.entries({
@@ -1530,6 +2088,7 @@ export class RailEngine {
       assertString(invocation.invocation_id, 'INVALID_REWORK_LAUNCH_RESERVATION', 'invocation.invocation_id');
       assertString(invocation.launch_nonce, 'INVALID_REWORK_LAUNCH_RESERVATION', 'invocation.launch_nonce');
       assertString(invocation.prompt_digest, 'INVALID_REWORK_LAUNCH_RESERVATION', 'invocation.prompt_digest');
+      if (this.#launchReconciled(invocation.launch_nonce)) fail('EXECUTION_LAUNCH_ALREADY_RECONCILED', 'reconciled rework launch nonce may not be reused');
       const attempt = this.#attempts().get(attempt_id);
       if (!attempt || attempt.state !== EXECUTABLE_ATTEMPT_STATE) {
         fail('ATTEMPT_NOT_ACTIVE', 'rework launch reservation requires an active attempt', { attempt_id });
@@ -1555,6 +2114,9 @@ export class RailEngine {
         || invocation.model_pin?.reasoning_configuration !== binding.reasoning_configuration) {
         fail('EXECUTION_BINDING_MISMATCH', 'rework launch reservation does not match the sealed task binding');
       }
+      if (admission_receipt !== null) this.#verifyExecutionAdmission({
+        attempt, invocation, receipt: admission_receipt, project_dir, harness_process_id,
+      });
       const reservation = [...this.#records].reverse().find((record) => record.type === 'rework_reserved'
         && record.payload?.attempt_id === attempt_id
         && record.payload?.source_decision_ref === source_decision_ref);
@@ -1572,7 +2134,8 @@ export class RailEngine {
       if (existing) {
         if (sha256(existing.payload.invocation) !== sha256(invocation)
           || existing.payload.reservation_id !== reservation_id
-          || existing.payload.claim_event_id !== attempt.claim_event_id) {
+          || existing.payload.claim_event_id !== attempt.claim_event_id
+          || sha256(existing.payload.admission_receipt ?? null) !== sha256(admission_receipt)) {
           fail('EXECUTION_LAUNCH_NONCE_CONFLICT', 'launch nonce is already reserved for different rework material');
         }
         return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
@@ -1580,6 +2143,7 @@ export class RailEngine {
       const unresolvedLaunch = this.#records.find((record) => record.type === 'rework_launch_reserved'
         && record.payload?.attempt_id === attempt_id
         && record.payload?.reservation_id === reservation_id
+        && !this.#launchReconciled(record.payload.invocation.launch_nonce)
         && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
           && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
       if (unresolvedLaunch) {
@@ -1589,6 +2153,7 @@ export class RailEngine {
         && record.payload?.attempt_id === attempt_id
         && record.payload?.run_kind === 'rework'
         && record.payload?.rework_reservation_id === reservation_id
+        && !this.#launchReconciled(record.payload.invocation.launch_nonce)
         && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
           && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
       if (unresolvedDispatch) {
@@ -1598,6 +2163,7 @@ export class RailEngine {
         attempt_id, claim_id, operator_id, harness_process_id,
         claim_event_id: attempt.claim_event_id, source_decision_ref,
         reservation_id, invocation, reserved_at: timestamp(this.#clock),
+        ...(admission_receipt ? { admission_receipt } : {}),
       });
       const record = this.#append('rework_launch_reserved', payload, reservation.event_id);
       return Object.freeze(canonicalize({ ...payload, event_id: record.event_id, replay: false }));
@@ -1635,6 +2201,7 @@ export class RailEngine {
       if (existing) return Object.freeze(canonicalize({ ...existing.payload, event_id: existing.event_id, replay: true }));
       const unresolvedLaunch = this.#records.find((record) => record.type === 'rework_launch_reserved'
         && record.payload?.reservation_id === reservation_id
+        && !this.#launchReconciled(record.payload.invocation.launch_nonce)
         && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
           && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
       if (unresolvedLaunch) {
@@ -1643,6 +2210,7 @@ export class RailEngine {
       const unresolvedDispatch = this.#records.find((record) => record.type === 'execution_dispatched'
         && record.payload?.run_kind === 'rework'
         && record.payload?.rework_reservation_id === reservation_id
+        && !this.#launchReconciled(record.payload.invocation.launch_nonce)
         && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
           && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
       if (unresolvedDispatch) {
@@ -1708,12 +2276,28 @@ export class RailEngine {
         fail('RAIL_ADJUDICATION_REQUIRED', 'a canonical AI adjudication decision is required before another review can be dispatched');
       }
       if (invocation.attempt_id !== attempt_id || invocation.action !== 'review') fail('REVIEW_INVOCATION_MISMATCH', 'review launch is not bound to this attempt');
-      const selected = selectCanonicalReviewer({
-        installation, snapshot,
-        builder_identity: {
-          provider_id: attempt.execution_binding.provider_id,
-          model_id: attempt.execution_binding.model_id,
-        },
+      const selected = attempt.review_binding
+        ? {
+          provider_id: attempt.review_binding.provider_id,
+          harness_id: attempt.review_binding.harness_id,
+          model_pin: {
+            model_id: attempt.review_binding.model_id,
+            catalog_snapshot_ref: snapshot.snapshot_id,
+            reasoning_configuration: attempt.review_binding.reasoning_configuration,
+          },
+        }
+        : selectCanonicalReviewer({
+          installation, snapshot,
+          builder_identity: {
+            provider_id: attempt.execution_binding.provider_id,
+            model_id: attempt.execution_binding.model_id,
+          },
+          clock: this.#clock,
+        });
+      assertEligibleInvocation({
+        installation,
+        snapshot,
+        invocation: { ...selected, action: 'review' },
         clock: this.#clock,
       });
       if (invocation.provider_id !== selected.provider_id
@@ -1721,7 +2305,9 @@ export class RailEngine {
         || invocation.model_pin?.model_id !== selected.model_pin.model_id
         || invocation.model_pin?.catalog_snapshot_ref !== selected.model_pin.catalog_snapshot_ref
         || invocation.model_pin?.reasoning_configuration !== selected.model_pin.reasoning_configuration) {
-        fail('NONCANONICAL_REVIEWER', 'review launch must use the strongest canonical independent reviewer');
+        fail(attempt.review_binding ? 'REVIEW_BINDING_MISMATCH' : 'NONCANONICAL_REVIEWER', attempt.review_binding
+          ? 'review launch must use the sealed task review binding'
+          : 'review launch must use the strongest canonical independent reviewer');
       }
       this.#verifyAuthority('review_launch', launch_receipt, {
         purpose: 'terminal_launch', authority_kind: 'rail_review',
@@ -1733,11 +2319,11 @@ export class RailEngine {
         working_dir: resolve(working_dir),
         prompt_digest: invocation.prompt_digest,
       });
+      assertTerminalLaunchContainment(launch_receipt, 'REVIEW_LAUNCH_RECEIPT_MISMATCH');
       if (launch_receipt.task_id !== attempt.task_id
         || launch_receipt.working_dir !== resolve(working_dir)
         || launch_receipt.prompt_digest !== invocation.prompt_digest
         || !/^[a-f0-9]{64}$/.test(launch_receipt.command_digest || '')
-        || launch_receipt.process_containment_kind !== 'bubblewrap_pid_namespace_v1'
         || typeof launch_receipt.process_containment_id !== 'string' || !launch_receipt.process_containment_id
         || !/^[a-f0-9]{64}$/.test(launch_receipt.process_containment_digest || '')) {
         fail('REVIEW_LAUNCH_RECEIPT_MISMATCH', 'review launch receipt must bind the canonical prompt, task, working directory and command');
@@ -1796,11 +2382,11 @@ export class RailEngine {
         working_dir: resolve(working_dir),
         prompt_digest: invocation.prompt_digest,
       });
+      assertTerminalLaunchContainment(launch_receipt, 'ADJUDICATION_LAUNCH_RECEIPT_MISMATCH');
       if (launch_receipt.task_id !== attempt.task_id
         || launch_receipt.working_dir !== resolve(working_dir)
         || launch_receipt.prompt_digest !== invocation.prompt_digest
         || !/^[a-f0-9]{64}$/.test(launch_receipt.command_digest || '')
-        || launch_receipt.process_containment_kind !== 'bubblewrap_pid_namespace_v1'
         || typeof launch_receipt.process_containment_id !== 'string' || !launch_receipt.process_containment_id
         || !/^[a-f0-9]{64}$/.test(launch_receipt.process_containment_digest || '')) {
         fail('ADJUDICATION_LAUNCH_RECEIPT_MISMATCH', 'adjudication launch receipt must bind the canonical prompt, task, working directory and command');
@@ -1866,6 +2452,7 @@ export class RailEngine {
         || terminal_authority_receipt.stdout_digest !== sha256(adjudication_output)) {
         fail('ADJUDICATION_TERMINAL_AUTHORITY_MISMATCH', 'adjudication observation does not bind its canonical launch and full stdout');
       }
+      assertTerminalCompletionContainment(terminal_authority_receipt, dispatch.payload.launch_receipt, 'ADJUDICATION_TERMINAL_AUTHORITY_MISMATCH');
       const parsedDecision = parseAdjudicationOutput(adjudication_output);
       if (sha256(parsedDecision) !== sha256(validateAdjudicationDecision(decision))) {
         fail('ADJUDICATION_PAYLOAD_MISMATCH', 'adjudication observation differs from terminal-authorized stdout');
@@ -1931,6 +2518,7 @@ export class RailEngine {
         || terminal_authority_receipt.terminal_id !== dispatch.payload.launch_receipt.terminal_id) {
         fail('REVIEW_TERMINAL_AUTHORITY_MISMATCH', 'review completion does not bind the canonical launch');
       }
+      assertTerminalCompletionContainment(terminal_authority_receipt, dispatch.payload.launch_receipt, 'REVIEW_TERMINAL_AUTHORITY_MISMATCH');
       assertString(git_dir, 'INVALID_REVIEW_DECISION', 'git_dir');
       assertString(result_commit_ref, 'INVALID_REVIEW_DECISION', 'result_commit_ref');
       const validated = acceptReview({ review, invocation, installation, snapshot, clock: this.#clock });
@@ -1972,7 +2560,7 @@ export class RailEngine {
       if (requiredReworkSource && executionEvidence.source_decision_ref !== requiredReworkSource) {
         fail('RAIL_REWORK_RESULT_REQUIRED', 'a successful canonical rework for the latest decision is required before another review');
       }
-      verifyCommitDescendsFrom({ git_dir, base_commit_ref: attempt.git_commit_ref, result_commit_ref });
+      verifyCommitDescendsFrom({ git_dir, base_commit_ref: attemptExecutionBase(attempt), result_commit_ref });
       const priorReviewEvidence = this.#reviewEvidence(attempt_id);
       const expected = decideReviewProgress({
         prior_review_evidence: priorReviewEvidence,
@@ -1985,7 +2573,7 @@ export class RailEngine {
       if (sha256(expected) !== sha256(decision)) fail('REVIEW_DECISION_MISMATCH', 'journal decision does not match canonical Review Council history');
       const record = this.#append('review_decided', {
         attempt_id, task_id: attempt.task_id, review_ref,
-        base_commit_ref: attempt.git_commit_ref, result_commit_ref,
+        base_commit_ref: attemptExecutionBase(attempt), result_commit_ref,
         review: canonicalize(validated),
         invocation: canonicalize(invocation),
         terminal_authority_receipt: canonicalize(terminal_authority_receipt),
@@ -2047,6 +2635,7 @@ export class RailEngine {
           || entry.terminal_authority_receipt.stdout_digest !== sha256(entry.adjudication_output)) {
           fail('ADJUDICATION_TERMINAL_AUTHORITY_MISMATCH', 'adjudication completion does not bind its canonical launch and full stdout');
         }
+        assertTerminalCompletionContainment(entry.terminal_authority_receipt, dispatch.payload.launch_receipt, 'ADJUDICATION_TERMINAL_AUTHORITY_MISMATCH');
         const parsedDecision = parseAdjudicationOutput(entry.adjudication_output);
         if (sha256(parsedDecision) !== sha256(validateAdjudicationDecision(entry.decision))) {
           fail('ADJUDICATION_PAYLOAD_MISMATCH', 'adjudication decision differs from terminal-authorized stdout');
@@ -2120,8 +2709,9 @@ export class RailEngine {
     });
   }
 
-  recoverAttempt({ attempt_id, operator_id, harness_process_id, git_dir, lease_ttl_ms = 300000 } = {}) {
+  recoverAttempt({ attempt_id, operator_id, harness_process_id, git_dir, lease_ttl_ms = 300000, expected_attempt_event_id } = {}) {
     return this.#exclusive(() => {
+    this.#assertAttemptRevision(attempt_id, expected_attempt_event_id);
     for (const [field, value] of Object.entries({ attempt_id, operator_id, harness_process_id })) assertString(value, 'INVALID_RECOVERY', field);
     assertString(git_dir, 'INVALID_RECOVERY', 'git_dir');
     const attempt = this.#attempts().get(attempt_id);
@@ -2136,23 +2726,60 @@ export class RailEngine {
       ? claimProcessPid(attempt)
       : observeStoppedClaimProcess(attempt);
     const successfulExecution = this.#executionEvidence(attempt_id, { successfulOnly: true }).at(-1);
-    const expectedRecoveryCommit = successfulExecution?.result_commit_ref ?? attempt.git_commit_ref;
+    const expectedRecoveryCommit = successfulExecution?.result_commit_ref ?? attemptExecutionBase(attempt);
     verifyLocalGitCommit({ git_dir, git_commit_ref: attempt.git_commit_ref });
     verifyLocalGitCommit({ git_dir, git_commit_ref: expectedRecoveryCommit });
+    const executionAdmissions = [];
+    const reconcileAdmission = (record, legacyCode) => {
+      if (!record.payload.admission_receipt) {
+        fail(legacyCode, 'automatic recovery cannot prove whether a legacy reserved provider launch started before the supervisor stopped', {
+          launch_nonces: [record.payload.invocation.launch_nonce],
+        });
+      }
+      if (record.payload.claim_event_id !== attempt.claim_event_id
+        || record.payload.harness_process_id !== attempt.claim.harness_process_id) {
+        fail('RECOVERY_ADMISSION_CLAIM_MISMATCH', 'execution admission belongs to another supervisor claim generation');
+      }
+      // A relinquished lease alone cannot prove an admission callback has
+      // stopped. The old owner must actually be gone before its nonce closes.
+      observeStoppedClaimProcess(attempt);
+      this.#verifyExecutionAdmission({ attempt, invocation: record.payload.invocation,
+        receipt: record.payload.admission_receipt, project_dir: git_dir,
+        harness_process_id: record.payload.harness_process_id });
+      executionAdmissions.push({ status: 'not_started', launch_nonce: record.payload.invocation.launch_nonce,
+        reservation_event_id: record.event_id, admission_receipt_digest: sha256(record.payload.admission_receipt) });
+    };
     const unresolvedLaunchReservations = this.#records.filter((record) => record.type === 'execution_launch_reserved'
       && record.payload?.attempt_id === attempt_id
+      && !this.#launchReconciled(record.payload.invocation.launch_nonce)
       && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
         && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
-    if (unresolvedLaunchReservations.length > 0) {
-      fail('RECOVERY_EXECUTION_LAUNCH_UNRESOLVED', 'automatic recovery cannot prove whether a reserved provider launch started before the supervisor stopped', {
-        launch_nonces: unresolvedLaunchReservations.map((record) => record.payload.invocation.launch_nonce),
-      });
-    }
+    for (const record of unresolvedLaunchReservations) reconcileAdmission(record, 'RECOVERY_EXECUTION_LAUNCH_UNRESOLVED');
+    const executionDispatches = [];
+    const dispatchResolved = (dispatch) => {
+      if (this.#launchReconciled(dispatch.payload.invocation.launch_nonce)) return true;
+      if (this.#records.some((record) => record.type === 'execution_recorded'
+        && record.payload?.execution_evidence?.receipt_nonce === dispatch.payload.invocation.launch_nonce)) return true;
+      const proof = this.#restorationProof(dispatch, { current: true });
+      if (!proof) return false;
+      const reservation = this.#records.find((record) => ['execution_launch_reserved', 'rework_launch_reserved'].includes(record.type)
+        && record.payload.attempt_id === attempt_id && record.payload.invocation.launch_nonce === proof.launch_nonce);
+      if (!reservation || reservation.payload.claim_event_id !== attempt.claim_event_id
+        || reservation.payload.harness_process_id !== attempt.claim.harness_process_id
+        || dispatch.payload.claim_id !== attempt.claim.claim_id || dispatch.payload.operator_id !== attempt.claim.operator_id) {
+        fail('RECOVERY_ADMISSION_CLAIM_MISMATCH', 'restoration belongs to another supervisor claim generation');
+      }
+      observeStoppedClaimProcess(attempt);
+      this.#verifyExecutionAdmission({ attempt, invocation: dispatch.payload.invocation,
+        receipt: reservation.payload.admission_receipt, project_dir: git_dir, harness_process_id: attempt.claim.harness_process_id });
+      this.#assertAdmissionDispatchBound(reservation, dispatch.payload.launch_receipt);
+      executionDispatches.push(proof);
+      return true;
+    };
     const unresolvedInitialDispatches = this.#records.filter((record) => record.type === 'execution_dispatched'
       && record.payload?.attempt_id === attempt_id
       && record.payload?.run_kind === 'initial'
-      && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
-        && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
+      && !dispatchResolved(record));
     if (unresolvedInitialDispatches.length > 0) {
       fail('RECOVERY_EXECUTION_DISPATCH_UNRESOLVED', 'automatic recovery cannot authorize another mutating provider after an interrupted initial dispatch', {
         launch_nonces: unresolvedInitialDispatches.map((record) => record.payload.invocation.launch_nonce),
@@ -2160,18 +2787,14 @@ export class RailEngine {
     }
     const unresolvedReworkLaunches = this.#records.filter((record) => record.type === 'rework_launch_reserved'
       && record.payload?.attempt_id === attempt_id
+      && !this.#launchReconciled(record.payload.invocation.launch_nonce)
       && !this.#records.some((candidate) => candidate.type === 'execution_dispatched'
         && candidate.payload?.invocation?.launch_nonce === record.payload.invocation.launch_nonce));
-    if (unresolvedReworkLaunches.length > 0) {
-      fail('RECOVERY_REWORK_LAUNCH_UNRESOLVED', 'automatic recovery cannot prove whether a reserved rework launch started before the supervisor stopped', {
-        launch_nonces: unresolvedReworkLaunches.map((record) => record.payload.invocation.launch_nonce),
-      });
-    }
+    for (const record of unresolvedReworkLaunches) reconcileAdmission(record, 'RECOVERY_REWORK_LAUNCH_UNRESOLVED');
     const unresolvedReworkDispatches = this.#records.filter((record) => record.type === 'execution_dispatched'
       && record.payload?.attempt_id === attempt_id
       && record.payload?.run_kind === 'rework'
-      && !this.#records.some((candidate) => candidate.type === 'execution_recorded'
-        && candidate.payload?.execution_evidence?.receipt_nonce === record.payload.invocation.launch_nonce));
+      && !dispatchResolved(record));
     if (unresolvedReworkDispatches.length > 0) {
       fail('RECOVERY_REWORK_DISPATCH_UNRESOLVED', 'automatic recovery cannot authorize another mutating provider after an interrupted rework dispatch', {
         launch_nonces: unresolvedReworkDispatches.map((record) => record.payload.invocation.launch_nonce),
@@ -2199,12 +2822,15 @@ export class RailEngine {
         ? { status: priorCompletion.payload.completion.ci.verdict, evidence_refs: priorCompletion.payload.completion.ci.evidence_refs }
         : { status: 'not_started', evidence_refs: [`rail-observation://ci/${attempt_id}/not-started`] },
       effects: effects.map((effect) => ({ idempotency_key: effect.idempotency_key, status: 'receipted', receipt_ref: effect.receipt_ref })),
-      execution_dispatches: [],
+      execution_dispatches: executionDispatches,
+      ...(executionAdmissions.length ? { execution_admissions: executionAdmissions } : {}),
     });
     const claim = canonicalize({
       ...attempt.claim,
       operator_id,
       harness_process_id,
+      hostname: hostname(),
+      ...(process.platform === 'darwin' ? { darwin_host_boot_identity: captureDarwinHostBootIdentity() } : {}),
       lease: { acquired_at: now, heartbeat_at: now, expires_at: plusMs(now, lease_ttl_ms) },
     });
     const resume_state = attempt.state;
@@ -2238,11 +2864,30 @@ export class RailEngine {
         assertObject(metrics[field], 'INVALID_COMPLETION_METRICS', `metrics.${field}`);
         assertString(metrics[field].unit, 'INVALID_COMPLETION_METRICS', `metrics.${field}.unit`);
         assertString(metrics[field].evidence_ref, 'INVALID_COMPLETION_METRICS', `metrics.${field}.evidence_ref`);
-        if (typeof metrics[field].value !== 'number' || !Number.isFinite(metrics[field].value) || metrics[field].value < 0) fail('INVALID_COMPLETION_METRICS', `metrics.${field}.value must be a non-negative finite number`);
+        const unknownProcessing = field === 'actual_ai_processing' && metrics[field].value === null
+          && metrics[field].coverage?.status === 'reconciled_incomplete';
+        if (!unknownProcessing && (typeof metrics[field].value !== 'number' || !Number.isFinite(metrics[field].value) || metrics[field].value < 0)) fail('INVALID_COMPLETION_METRICS', `metrics.${field}.value must be a non-negative finite number or verified incomplete processing`);
+      }
+      if (metrics.actual_ai_processing.coverage !== undefined || this.#records.some((record) =>
+        record.type === 'execution_worktree_restored' && record.payload.attempt_id === attempt_id)) {
+        const processing = collectProviderProcessing(this.#records, { attempt_id,
+          verifyAuthority: (kind, receipt, expected, context) => this.#verifyAuthority(kind, receipt, expected, context) });
+        if (sha256(metrics.actual_ai_processing) !== sha256(providerProcessingMetric(processing, metrics.actual_ai_processing.evidence_ref))) {
+          fail('COMPLETION_PROCESSING_COVERAGE_MISMATCH', 'processing values, subtotal and unknown invocation proofs must match the canonical journal');
+        }
       }
       if (!Number.isInteger(metrics.rework_cycles) || metrics.rework_cycles < 0) fail('INVALID_COMPLETION_METRICS', 'metrics.rework_cycles must be a non-negative integer');
       assertStringArray(metrics.rework_review_refs, 'INVALID_COMPLETION_METRICS', 'metrics.rework_review_refs');
       if (metrics.rework_review_refs.length !== metrics.rework_cycles) fail('INVALID_COMPLETION_METRICS', 'each rework cycle requires one review reference');
+      const metricRefs = [metrics.actual_human_effort.evidence_ref, metrics.actual_ai_processing.evidence_ref,
+        completionMetricsReference({ attempt_id, commit_ref: git.result_ref, metrics })];
+      if (!metricRefs.every((ref) => acceptance_evidence_refs.includes(ref))) {
+        fail('COMPLETION_METRICS_BINDING_REQUIRED', 'certified acceptance must include metric sources and the exact attempt, commit, values, units and rework commitment');
+      }
+      if (metricRefs.slice(0, 2).some((ref) => ref.startsWith('rail-verification://sha256/'))
+        && metrics.source_journal_digest !== effortJournalDigest(this.#records, attempt_id)) {
+        fail('COMPLETION_METRICS_STALE', 'local observed metrics must cover the current effort and provider journal inside the completion transaction');
+      }
     }
     const existing = this.#records.find((record) => record.type === 'attempt_completed' && record.payload.completion.completion_id === completion_id);
     if (existing) fail('COMPLETION_ALREADY_EXISTS', 'completion_id is immutable', { completion_id });
@@ -2264,7 +2909,7 @@ export class RailEngine {
         commitRef: git.result_ref,
         acceptanceEvidenceRefs: acceptance_evidence_refs,
         delegationManifest: browserDispatch?.payload?.browser_manifest,
-        verifyAuthority: (receipt, expected) => this.#verifyAuthority('browser_evidence', receipt, expected),
+        verifyAuthority: (receipt, expected, context) => this.#verifyAuthority('browser_evidence', receipt, expected, context),
       });
     } else if (browser_evidence !== undefined) {
       fail('UNEXPECTED_BROWSER_EVIDENCE', 'non-browser task completion must not claim real browser evidence');
@@ -2273,7 +2918,7 @@ export class RailEngine {
     this.#assertLiveLease(attempt, timestamp(this.#clock));
     assertString(git.base_ref, 'INVALID_COMPLETION', 'git.base_ref');
     assertString(git.result_ref, 'INVALID_COMPLETION', 'git.result_ref');
-    if (git.base_ref !== attempt.git_commit_ref) fail('GIT_BASE_MISMATCH', 'completion base_ref must equal the sealed attempt commit', { attempt_id });
+    if (git.base_ref !== attemptExecutionBase(attempt)) fail('GIT_BASE_MISMATCH', 'completion base_ref must equal the journal-bound attempt execution base', { attempt_id });
     if (!git.commit_refs.includes(git.base_ref) || !git.commit_refs.includes(git.result_ref)) {
       fail('GIT_COMMIT_MISMATCH', 'completion commit_refs must include both sealed base and reviewed result commits', { attempt_id });
     }