[KimGLee]

Summary

Closes #219.

Connect receipt selection, validation dependencies and original reconciliation across pre-merge, close, closed-state and Terminal consumption. Later consumers follow the exact admitted stage selection; they do not rescan historical passes or discard the first-round body required by an L second-round review.

Changes by owner

• Audit runtime: separate candidate enumeration from exact acceptance-dependency reads; preserve frozen reconciliation and formal invalidation. Keep live currentness at production/merge admission and the independent post-Delta closure.
• Batch Review / Runner: use one current-wrapper selector; accept only exact declaration reuse, preserve the original receipt identity and reject genuine current conflicts under the write lock.
• Publication / close: derive reuse reporting from existing publication facts; preflight pre-merge handoff before child publication while keeping final fresh observation, CAS, aggregate-last and read-back.
• Profile / register mechanics: share parsing and stable calculations in the existing read-only observation. Terminal assembly/checking use the same exact named-register membership owner; readable history never supplies missing current authority.
• Retirement: remove the cross-stage boolean/global-rescan path, produced-only catalog helper, test-only stage helper chain, Runner's duplicate wrapper scan, duplicate register parsers, redundant publication reuse argument and obsolete consumers.
• Projections / tests: regenerate current interface catalogs and the eight existing checkpoint bundles using native generators. Keep the same test files and full lifecycle count; extend the existing MCP Runner E2E with one bounded natural revision on its small S batch, retaining the distinct formal-withdrawal scenario.

Kernel/Profile governance semantics, public CLI/MCP arguments, Receipt schemas, CI configuration and protection are unchanged. No adopter runtime, page, task or lock is modified by this PR.

Validation

• 119 focused owner and seam tests passed (4.579 s); overlapping earlier runs are not added to this count.
• Seven real close/publication/Queue checkpoint tests passed (20.003 s), including partial-publication lock retention and current close/Terminal evidence remaining outside the seal plan and in the required register.
• Module boundaries, ordinary attempt and post-Delta contract checks passed. The bounded README check initially caught excessive prose; the guide was shortened without changing the bound, and its 11 owner tests passed (0.356 s).
• make check passed, including generated CLI/MCP/Host and Tool/Test catalogs.
• Eight checkpoint bundles were generated by their existing generators and verified through their native loaders (8/8); all 196 manifest members were checked in the index, including 12 new generated identity filenames.
• The first fixed-commit MCP E2E caught a register-read regression before opening a batch: an append capability's admission-time absence was incorrectly used instead of the receipt I/O owner's after-image. The existing MCP after-image test now exercises the actual shared register consumer and fails on the superseded implementation. No path-safety or current-authority checks were relaxed.
• On candidate 335b5b3f6986ad52bcc83a96b13983047603bbbb, 34 focused after-image/register/reporting tests passed (0.108 s), the real MCP Task Plan-to-Queue prologue passed, and seven refreshed close/Queue/publication checkpoint tests passed (19.723 s). These overlap earlier owner runs and are not added into a synthetic total.
• Regenerated the eight affected checkpoints with native generators and refreshed the Test Catalog afterward. All deterministic checks passed, with the final catalog consistency check rerun after that refresh. Test/fixture/E2E counts remain unchanged from the first candidate.
• Final protected CI passed: verify 34391258283, all 24 jobs including ci-required. All 20 cost reports were checked: Python 3.10.21 and 3.14.7 each passed 1,304 cases across 134 files with no duplicate methods/files across their shards. The merge-ref tree exactly matches candidate 335b5b3.
• Both real MCP Runner E2Es completed two batches through closed, then Terminal Proof and Task completion. Each made 87 MCP calls and 73 batch actions, retaining the original formal withdrawal and adding five actions for the bounded natural-revision path. No direct leaf-tool bypass was restored.
• E2E module times: 555.700 s (3.10) and 867.257 s (3.14). Jobs finished in 9m41s and 14m43s under the unchanged 15-minute limit. The 3.14 margin is only 17 seconds; this is not a claim of ample performance headroom. No workflow timeout, protected check, or test selection was weakened.

The final acceptance combines actual stage handoff with the owner-level rejection boundaries, not local helper passes alone. These results establish the tested current-contract lifecycle; they do not claim that all possible future receipt defects have been eliminated.