[rdpollard]

Implement the fixed Mint session archival/setup inspector and executor for the reviewed procedure, preserving the successful checkout tree and older failed media session before any future fresh runner setup. This prepares local tooling only; it does not execute archival or change activation.

Pin fixed paths/ownership/modes/ACLs and original session identity; inspect bounded proc UID/thread/capability/parent/start-time evidence with retained pidfds; reject unrelated account processes, changed observations, registration remnants and archive/journal collisions. Use only libc renameat2 RENAME_NOREPLACE, exclusive private directory creation, bounded append-only fsynced/read-back phase journal and no retry/rollback/delete/repair fallback. Defer signal interruption to checked boundaries so descriptor ownership can be enrolled safely. Require explicit entrypoint authorization and refreshed injected owner attestations; these are not authenticated IPC or independent GitHub settings verification.

Review fixed missing journal identity/content revalidation before progression and added path/process/journal revalidation before work-root creation. Preserve separate descriptor/umask/signal cleanup outcomes rather than hiding concurrent failures. No CLI, host delivery, automatic native invocation, process launcher, package/service or recovery executor exists.

QA: 165 mocked/static checks passed, including 31 inspector/controller tests; focused actionlint, whitespace and full-branch exact infrastructure-scope controls passed. The automatic policy workflow adds only the mocked suite and its exact paths; application/key mixed changes retain normal application CI. Existing launcher, media source guard/transport/validator, manual workflow definitions and production code are unchanged.

Native atomicity, proc/pidfd/ACL behavior, crash durability and reconciliation remain unvalidated. The 30-second budget is checked, not a hard real-time guarantee for blocking OS/NSS/fsync calls. Verified delivery, gate attestation, bounded report export and external execution supervision require review before separately authorized host operations. Diagnostic completion is distinct from authentication safety and whole-host cleanup.

Keep this PR unmerged and #73 draft/unmerged. No host execution, activation changes, runner registration/start, workflow dispatch, downloads, guests, application builds, packages or releases were performed or authorized by this publication.

[rdpollard]

Final readiness assessment at a2bfffa: no additional implementation defects found in this pass. No code changes required. Re-ran 165 mocked/static checks, focused actionlint and git diff --check: passed. Full branch is exact infrastructure-only scope; mixed application/key controls retain normal CI. Byte comparison confirms manual workflows, private launcher and media caller/core/native transport unchanged.

Current GitHub: MERGEABLE/CLEAN, policy/scope/workflow-checks successful. Windows/Mint native fixtures and application checks/native/update-trust/release jobs skipped. Suitable to merge as isolated preparation tooling, subject to GitHub requirements on the eventual merge. Both #81 and #73 remain unmerged; #73 draft.

Execution gates are separate from merge readiness:

1. Reviewed verified-file delivery and caller, owner-attested live remote controls, bounded report persistence and external supervisor. The module has no CLI/handoff and its checked 30-second budget is not a hard bound for blocking OS/NSS/fsync calls.
2. Explicit fresh authorization for narrowly scoped local archival/setup operations; current activation stays disabled. No runner, dispatch or media permission follows from this PR.
3. Fresh read-only preflight: expected source inode/device, archive/journal absence, absent registrations/queued jobs, account/controller quiescence, ACLs, trusted tool/source hashes. Unexpected state stops for reconciliation, not deletion/retry.
4. Native proc/pidfd/ACL/renameat2 and filesystem durability remain unvalidated. If separately authorized execution reaches unsupported behavior, interruption or persistence uncertainty, retain source/archive/journal/partial setup and stop. Require read-only reconciliation; no automatic rollback/resume. Lost export or completed journal plus cleanup failure is not unqualified success.

No further product decision is needed to merge this preparation tooling. Local mock success does not prove native atomicity/crash recovery, authentication safety or whole-host cleanup. Sole-maintainer self-approval remains allowed; no settings changed and no native/host operations, activation, runner actions, dispatch, downloads, guests, packages, builds or releases executed.

[rdpollard]

Merged reviewed head a2bfffa through the normal GitHub merge path, exact-head guarded and without admin bypass, as 887ebc9. Pre-merge policy/scope/workflow-checks passed; native fixtures/application jobs were skipped.

Post-merge main: run 39135104618 policy passed; run 39135104627 scope passed and checks/native/update-trust/release all skipped. No manual workflow dispatch or application/native build occurred.

#73 remains open and draft. Activation settings and the spare host were untouched; no runner operations, downloads, guests, packages or releases. The merged implementation remains unexecuted natively. Verified delivery, refreshed control attestations, bounded report persistence/external supervision and fresh explicit host-operation authorization remain gates before actual archival/setup; uncertain state requires read-only reconciliation, not automatic retry/rollback. Sole-maintainer self-approval stays allowed.