[Tim55667757]

A completed guest transition must become one durable local protocol epoch without losing its closed peer history when the controller stops. Add a private journaled publisher: retain the full expected public candidate before requesting completion; require a separately supplied exact authenticated response before recording observed, publishing the next empty peer namespace/head, and retiring known terminal ingress metadata and the publication journal last.

Recovery preserves source files and prior peer segments, finishes only ordered exact immutable file prefixes, and refuses lost authority, unknown dispatch, stale pointers, gaps, replacement inodes, membership ABA and reappearing metadata. Complete immutable descriptors remain pinned across segment/head/cleanup, final traversal and context exit. Late drift preserves/restores the same observed protection; mutating project admission synchronizes final namespace absence before any subsequent peer/guest write. Read-only coordination does not repair or synchronize.

Continues #128; does not close it. This backend performs no real cloud/guest attestation or dispatch. Protocol RPC, a concrete non-target-service observer, full coordinator and public CLI remain integration work. No production, desktop VPN, WSL, credentials, keys or local network changes.

Validation on exact head 5b26c43:

• Canonical Linux gate: compileall, naming, Ruff, mypy (82 files), 3662 passed / 9 skipped; coverage 90.28%.
• Strict installed-wheel EN/RU/ZH documentation: 99 tests passed; 444 approved generated units per locale.
• Reproducible installed artifacts: wheel/sdist audit passed, reproducible=true, 5 installed tests passed.

Added 64 deterministic cases covering codec/consent, publication interruption, ordered/partial prefixes, repeated native epochs, private-source loss, expected-old authority, replacement/ABA, lifetime pins and failed directory barriers. All new POSIX cases ran in Linux CI. ADR/engineering and reviewed RU/ZH catalogs updated. Independent exact-head AI static review found no remaining actionable findings; see the review COMMENT.

[Tim55667757]

Independent AI static review completed for exact head 5b26c43 against 9e5a715. The separate reviewer found no remaining actionable findings after fixes for durable post-unlink admission, complete immutable snapshot pinning through all later barriers and final context exit, exact expected-old mutable authority, and protective-journal restoration after late snapshot drift. EN/RU/ZH semantics and all four source/translation provenance pairs agree. Static review did not execute tests. Proceeding remains conditional on all three exact-head CI gates passing. This COMMENT records independent AI review, not a human APPROVE.

[Tim55667757]

Reviewed